Industry  movers  look  to  alter 
landscape  of  the  data  center 


IBM  says  the  time  has  arrived 
to  automate  more  operations 


EMC’s  forecast:  cloud  storage 
with  a  deluge  of  flash  drives 
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BY  DENISE  DUBIE 

ORLANDO  —  IBM  intends  to  transform  how  data  centers 
operate  for  customers  looking  to  reduce  manual  labor,  cut 
costs  and  put  in  place  a  more  energy- 
efficient  infrastructure. 

At  its  inaugural  Pulse  Conference 
in  Orlando  last  week,  IBM  laid  out  a 
vision  for  how  its  management  soft¬ 
ware  products  can  be  used  to  drive 
automation,  increase  computing 
efficiencies  and  reduce  labor  costs. 

The  show  drew  more  than  4,000 
attendees  and  focused  on  hands-on 

labs,  tutorials  and  sessions  on  IBM’s  _  _ 

management  software  offerings. 

“For  all  we  have  accomplished,  we 
are  still  challenged  with  the  issues 
of  visibility,  control  and  automa¬ 
tion,”  says  Steve  Mills,  senior  vice 
president  and  group  executive  of  IBM  Software  Group.“We 
are  now  in  a  position  to  create  a  common  control  environ¬ 
ment  as  we  evolve  toward  full  automation.  IT  will  be  the 
vehicle  to  take  the  labor  problem  out  of  the  challenge  of 
controlling  the  world’s  infrastructure.  It’s  a  simple  idea,  but 
it’s  not  easy  to  do.” 

See  IBM,  page  22 


IBM  SVP  Steve 
Mills:  Solving  the 
labor  problem 


BY  JON  BRODKIN 

LAS  VEGAS  —  EMC  executives  contend  that  enterprise 
flash  drives  and  cloud  storage  will  profoundly  change  their 
industry  over  the  next  five  to  10  years, 
offering  faster,  more  efficient  storage, 
and  highly  scalable,  Web-based  plat¬ 
forms  that  reduce  demand  on  data 
centers. 

At  last  week’s  EMC  World  in  Las 
Vegas,  the  company’s  annual  meeting 
for  customers,  partners,  analysts  and 
media,  CEO  Joe  Tucci  and  his  team 
spoke  optimistically  about  both  tech¬ 
nologies  and  offered  a  few  details 
about  how  EMC  intends  to  use  them. 

Tucci  called  flash  “the  one  thing 
that  will  change  the  storage  industry 
more  than  anything  else  over  the 
next  10  years.”  He  also  promised  that 
Maui,  the  software  component  of  EMC’s  future  cloud-storage 
offering,  would  start  shipping  this  summer. 

The  potential  of  flash  and  cloud  storage  “are  the  two 
themes  that  are  starting  to  resonate  as  far  as  what’s  next,”  says 
Enterprise  Strategy  Group  analyst  Brian  Babineau. “Cloud 
computing  has  been  getting  a  lot  of  attention  because  we 

See  EMC,  page  20 


EMC  CEO  Joe 
Tucci:  Flash  is 
industry  changer 


Forrester /Network  World 
survey  reveals  critical  need  to 
centralize  device,  network  and 
application  management. 

Page  32. 


The  network  behind 
the  Venetian 


A  10G  Ethernet  core 
network,  plus  lots  of 
virtual  LANs,  keep 
the  Vegas  resort 
humming.  Page  14. 


800,000  down,  1.2  million  to  go 

Sales  of  encryption  software  to  U.S.  govern¬ 
ment  agencies  boom  against  backdrop  of 
more  stolen  laptop  cases.  Page  11. 


Wireless  confidential 

Lockheed  Martin’s  newly  opened  wireless-security  laboratory 
offers  a  view  of  commercial,  military  wireless-security  threats. 

Page  16. 


How  will  Microsoft 
pull  off  0DF? 

Software  giant  says 
right  things,  but  its 
actions  will  deter¬ 
mine  if  format  debate 
is  headed  in  right 
direction.  Page  19. 


What’s  so  scary 
about  DLP  tools? 


Data-loss  prevention 
gear  can  highlight 
poor  data  practices, 
raise  legal  issues, 
early  adopters  say. 
Page  20. 


Should  your  IT 
staff  telework? 


Technology  is  better 
but  companies  are 
split  on  whether  it’s  a 
good  idea  to  let  IT 
employees  work  from 
home.  Page  23. 
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IN  THE  WORLD  OF  ENTERPRISE  INTEGRATION 

I  need  a  solution  that  runs  like  clockwork  or  I  run  the  risk  of  running  a  lot  of  stairs. 


30R0CK 


CELEeRAT/NG 


Brands  that  have  revolutionized  online 
business  have  one  thing  in  common... 


MIAMI  VlCi 


Akamai,  Enabling  the  Revolution 


A  lot  can  happen  in  ten  years.  Especially  with 
Internet  technology  that's  revolutionizing  virtually 
every  facet  of  business.  New  sales  channels.  New 
applications  and  advertising  models.  In  our  first 
ten  years,  Akamai  has  helped  the  world's  leading 
businesses  become  the  world's  leading  online 
businesses.  And  we're  just  getting  started. 

Learn  more  at  www.akamai.com/10years 


Hulu  puts  the  audience  in  control,  letting  viewers 
choose  when,  where  and  how  they  tune  into  their 
favorite  TV  shows,  movies,  clips  and  more.  With 
thousands  of  videos  spanning  every  genre,  Hulu  makes 
it  easy  to  use  and  share  premium  programming  — all 
for  free  and  on  demand.  Offering  the  latest  primetime 
favorites,  classic  episodes  of  vintage  shows,  feature 
films  and  a.whdle  lot  more,  Hulu  is  revolutioninizing 
the  way  audiences  watch  online. 


L.  Akamai 
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■  Built-in  Wi-Fi  makes  the  TZ50  a  gem. 
See  Cool  Tools,  page  30. 
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Antiphishing  freebies 

ING  Direct  Bank,  an 
online  bank  with  6.5  mil¬ 
lion  customer  accounts, 
has  begun  offering  free 
antiphishing  soft¬ 
ware  to  its  cus¬ 
tomers.  Sure,  the 
Windows-based 
Rapport  software 
made  byTrusteer 
only  sells  for  $20, 
but  still,  free  is 
free. 
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Cisco  and  China,  again 

Cisco  last  week  denied  allegations 
that  it  aided  the  Chinese  govern¬ 
ment  in  its  effort  to  censor  the 
Internet.The  allegations  are  con¬ 
nected  to  a  2002  PowerPoint  docu¬ 
ment  written  by  a  Cisco  engineer 
that  refers  to  suppression  of  the 
Falun  Gong  religious  group  and 
"other  hostiles.”  Cisco  said  the 
internal  document  does  not  reflect 
the  company’s  views,  according  to 
AP  and  Reuters  reports.The  Cisco 
document  resurfaced  during  a 
Senate  Judiciary  Committee  hear¬ 
ing  last  week  regarding  Internet 
censorship. 


Government  IT  security  gets  a  C 
More  than  a  third  of  the  24  agencies 
graded  by  U.S.  Rep. Tom  Davis  (R- 
Va.)  for  the  seventh  annual  report 
card  on  computer  security  at  fed¬ 
eral  departments  and  agencies 
received  Fs  for  2007. The  good 
news:The  overall  grade  of  a  C  was 
up  from  a  C-  the  year  before. 


Forrester  Research-Network  World 
survey  reveals  critical  need  to 
centralize  device,  network  and 
application  management.  Pjjgg 


Mobile  ope 

A  critical  consideration  for 
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Interoperability  of  gaming 
software 

Re:  World  of  Warcraft  license  spat  could  be 
trouble  for  IT  (www.nwdocfinder.com/5030): 

I  don’t  think  we  have  to  worry  too  much 
about  software  vendors  filing  lawsuits  to  pre¬ 
vent  other  software 
from  interoperating 
with  their  own  prod¬ 
ucts.  For  example,  VB 
Scripts,  VBA  modules 
and  Office  macros  all 
enhance  the  underly¬ 
ing  products,  making 
them  more  valuable 
to  the  users  and  ven¬ 
dors  alike.  The  online 
game  situation  is  dif¬ 
ferent  in  part  because  people  pay  monthly  fees 
to  participate  and  in  some  cases,  can  earn  real 
world  money  from  their  activities.  Although  1 
wouldn’t  like  to  see  that  kind  of  [user  license 
agreement]  violation  considered  copyright 
infringement  (EULAs  need  a  serious  overhaul 
and  specific  legal  guidelines,  but  not  from  the 
courts!),  Blizzard  should  be  able  to  protect 
their  franchise  somehow.  Maybe  they  just  need 
better  lawyers. 

Paul  Ames 

Discuss  at  www.nwdocfinder.com/5031 

WAAS  notes 

Editor's  note.App  Performance  View  bloggers 
Peter  Seucik  and  Rebecca  Wetzel  asked  readers 
for  their  experiences  with  Cisco's  Wide  Area 
Application  Services  ( www.nwdocfinder.com/ 
5032).  Here’s  one  response: 

One  of  our  key  requirements  for  WAN  opti¬ 
mization  was  the  ability  to  accelerate  our 
Bentley  ProjectWise  document-management 
system,  as  well  as  AutoCAD  application.  This 
allows  us  to  maintain  compliance  with  our 
branch  server-centralization  strategy,  while  still 
maximizing  our  consultant  billable  hours  and 
revenue  through  LAN-like  performance  over 
the  WAN. 

Throughout  the  past  18  months,  we  are  sav¬ 
ing  $4,000  to  $7,000  a  month  on  bandwidth, 
and  have  gained  about  $1.2  million  net  bene- 


**If  the  company  requires  the 
degree  and  doesn’t  bother  to 
consider  the  experience,  then 
you  don’t  want  to  work  for 
the  company.55 
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To  get  the  client 
software,  use  your  phone  browser  to 
visit  wap.connexto.com 

For  more  information  on  code  scanning 
see  www.nww.com/codescan 


fits  through  more  productive  consultants.  The 
Cisco  WAAS  solution  we  picked  gave  us  addi¬ 
tional  ease-of-operations  and  management 
advantages,  because  of  its  transparent  integra¬ 
tion  with  our  WAN  QoS,  security  VoIP  and  mon¬ 
itoring  services.  We  can  continue  to  use  these 
services  with  the  visibility  we  need;  the  saying 

“you  can’t  manage  if 
you  can’t  see”definite- 
ly  applies  to  us.  Be¬ 
cause  of  the  industry 
we’re  in  and  the  size 
of  the  datasets  we 
work  with,  imple¬ 
menting  a  WAN-opti- 
mization  technology 
was  a  no-brainer;  and 
Cisco’s  WAAS  solution 
has  not  only  delivered 
on  the  promised  R0I  but  delivered  sooner 
than  we  ever  imagined. 

Jeff  Gill  and  Hugh  Barnett,  A&I  team 
Michael  Baker  Corp. 

Discuss  at  www.nwdocfinder.com/5032 

He’ll  take  real-world  experi¬ 
ence  any  day 

Re:  Ron  Nutter’s  Job  Hunt:  Day  61 :  Missed  sig¬ 
nals  (www.nwdocfinder.com/5033): 

If  the  company  requires  the  degree  and 
doesn’t  bother  to  consider  the  experience, 
then  you  don’t  want  to  work  for  the  company. 

I  completed  two  years  of  my  four-year 
degree  back  in  the  early  ’90s.  I  have  since  then 
completed  many  certifications  (up  to  CCIE) 
and  have  15  years  of  experience. 

If  the  employer  thinks  someone  with  a 
degree  is  better  then  that  —  well,  let’s  just  say 
it  may  as  well  be  an  episode  of  “The  Office”  or 
a  Dilbert  cartoon. 

Alfred  Gard 

Discuss  at  www.nwdocfinder.com/5033 

Test  jitters 

Re:  What  makes  you  lose  sleep  before  the 
exam?  (www.nwdocfinder.com/5034): 

I  had  spent  around  nine  months  studying 
between  reading  and  using  my  home  lab 
for  hands-on  practice,  and  felt  that  I  knew 
the  material  pretty  well.  However,  I  had 
heard  people  or  read  posts  on  the  Web 
going  on  about  how,  given  the  number  of 
questions  on  the  exam  and  the  time  allot¬ 
ted  for  the  exam,  you  did  not  have  that  long 
per  question.  1  had  also  heard  or  read  hor¬ 
ror  stories  about  the  number  and  type  of 
simulation  questions. 

It  was  this  fear  of  not  knowing  what  was 
facing  me  which  caused  my  nerves  to  jin¬ 
gle,  more  so  than  any  of  the  topics  I  had 
covered. 

Michael  Keeley 

Discuss  at  www.nwdocfinder.com/5034 

E-mail  letters  to  jdix@nww.com  or  send  them  to 
John  Dix,  editor  in  chief,  Network  World,  118 
Turnpike  Road,  Southborough,  MA  01 772.  Please 
include  phone  number  and  address  for  verification 
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in  and  Earth's  Moon 


Explore  space  from 
your  PC 

The  final  frontier  is 
now  within  reach  for 
students  and  space 
enthusiasts  with  a  new 
Web  application  that 
incorporates  images 
from  the  best  ground- 
and  space-based 
observatories. 


Advanced  Web 
access  management 
techniques 

P2  Security's  Jeff 
Gresham  further 
explains  how  the  vari¬ 
ous  layers  ofWeb 
access  management 
can  be  combined  and 
simplified  while  scaling 
to  meet  demand. 
www.nwdocfinder.com/5042  www.nwdocfinder.com/5043 


Stopping  employee 
tailgaters 

A  new  security  system 
from  Fujitsu  aims  to 
catch  employee  tailgat¬ 
ing,  where  someone  fol¬ 
lows  an  authorized  staff 
member  into  a  secure 
area. 

www.nwdocfinder.com/5044 
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‘Stickiness’  factor  in  Wi-Fi  nets 


I BLOGOSPHERE _ 

H  OK,  OK,  I  need  a  real  phone.  Michael 
Morris  writes  in  his  From  the  Field  blog:  “I 
read  a  Gartner  report  last  year  about  unified 
communications  that  said  the  future  is  soft- 
phones.  People  have  been  buying  Cisco  IP 
phones  for  $400  a  piece  for  a  while,  making 
Cisco  very  happy.  The  Gartner  report  made 
the  case  that  enterprises  should  stop  buying 
expensive  desk  phones,  which  are  mini-PCs 
(they  have  an  OS,  run  Java,  and  can  run 
applications),  and  use  the  real  PC  right  next 
to  the  phone  to  run  a  softphone.  This  cuts 
hardware  investment,  maintenance  and  oper¬ 
ational  support.  That  all  made  sense  to  me. 
Why  buy  a  separate  piece  of  hardware  when 
you  have  a  system  right  there  that  can  do 
everything?  And  then  I  started  using  a  soft- 
phone  the  last  few  months.  It’s  nice.  I  have  my 
work  phone  number  where  I  am  working,  par¬ 
ticularly  at  home.  And  while  traveling  I  have  a 
way  to  make  phone  calls  other  than  the 
mobile  phone.  But  a  total  replacement  for  my 
desk  phone  it  is  not.”  www.nwdocfind 
er.com/5038 

■  Cloud  storage  divided  by  national 
boundaries.  Mitchell  Ashley  writes  in  his 
Converging  on  Microsoft  blog,  “Will  national 
and  political  interests  divide  up  cloud  stor¬ 
age  and  computing?  That  topic  came  up  at 
Interop  last  month  in  Las  Vegas  during  a  side 
conversation  with  an  employee  of  the  Cana¬ 
dian  government.  He  stated  that  the  Cana¬ 
dian  government  IT  organizations  were  not 
permitted  to  use  services  which  stored  or 
hosted  the  government's  data  outside  their 
sovereign  territory. They  especially  could  not 
use  services  in  which  data  was  stored  in  the 
United  States  because  of  fears  over  the 
Patriot  Act.  Whoa.  That  brings  up  reminders 
of  conflicts  governments  have  introduced  to 
the  Internet,  such  as  Google  cooperating 
with  the  Chinese  government.  The  same 
could  happen  when  your  data  is  stored  in  the 
cloud.”  www.nwdocfinder.com/5039 

■  Wii  Fit  =  Mii  Fat.  Keith  Shaw  writes  in  his 
Cool  Tools  Happy  Blog,  “I  got  Nintendo’s  Wii 
Fit  exercise  “game”  today,  which  includes  a 
new  accessory  for  the  Nintendo  Wii  system 
(the  Balance  Board)  and  a  bunch  of  video 
game  exercises  that  aim  to  help  you  get  fitter 
through  yoga,  balance  games,  strength  train¬ 
ing  and  aerobics.  I  ran  through  the  first  set  of 
exercise  games  and  went  through  the  regis¬ 
tration  process,  where  you  step  on  the  bal¬ 
ance  board  and  it  measures  your  body  mea¬ 
surement  index  (or  body  mass  index)  and 
weight.  The  game  pulls  no  punches.  It  basi¬ 
cally  told  me  that  for  my  height,  weight  and 
age,  that  I  was  obese.  Yowza.”  www.nwdoc 
finder.com/5040 


Wireless:  In  a  perfect  world,  any  Wi-Fi 
Alliance-certified  802.1 1  client  device  would 
perform  consistently  with  any  alliance-certi¬ 
fied  access  point  of  the  same  network  type. 
However,  the  alliance  certifies  products  for 
interoperability  only;  it  makes  no  statements 
about  how  well  any  client/AP  pair  performs. 
There  will  be  some  variability  in  the  perform¬ 
ance  of  different  client  devices.  Asking  a 
prospective  system  vendor  about  how  client- 
to-AP  associations  and  roaming  happen  is  not 
a  bad  idea.  In  the  majority  of  systems  avail¬ 
able  today  it  is  the  client  that  makes  the  deci¬ 
sion  about  which  AP  it  connects  to  and  when 
it’s  time  to  roam  to  a  different  APThe  excep¬ 
tions  are  Meru  Networks  and  Extricom,  which, 
instead,  move  the  decisions  to  the  centralized 
controller  in  an  effort  to  get  greater  and  more 
consistent  overall  network  performance. 
www.nwdocfinder.com/5037 

IT  careers  and  training:  By  now  you’ve 
probably  heard  the  phrase  “enterprise  archi¬ 
tect.”  People  in  the  know  are  hard-pressed  to 
describe  exactly  what  an  enterprise  architect 
is,  but  they  say  one  thing  is  clear:  the  relatively 
new  job  title  represents  a  growing  and  lucra¬ 
tive  field  for  IT  pros.  An  enterprise  architect  is 
sort  of  like  a  city  planner,  says  Allen  Brown, 
president  and  CEO  of  the  Open  Group,  a  stan¬ 
dards  organization.  Rather  than  tinkering  with 


individual  pieces  of  hardware  and  software, 
the  architect  attempts  to  ensure  proper  inte¬ 
gration  of  all  the  infrastructure  and  applica¬ 
tions  throughout  an  organization,  Brown  says. 

www.nwdocfinder.com/5036 

Tech  executive:  Linda  Musthaler  is  a  volun¬ 
teer  member  of  the  IT  Committee  for  the 
nation’s  largest  Girl  Scout  council.  Located  in 
southeast  Texas,  the  Girl  Scouts  of  San  Jacinto 
Council  (GSSJC)  organization  serves  more 
than  70,000  girls  and  19,000  adult  volunteers 
—  a  total  of  almost  90,000.The  organization  is 
expected  to  reach  a  membership  of  100,000 
within  the  next  few  years.  An  organization  of 
this  size  has  a  lot  of  communication  needs. 
For  instance,  girl  members  and  their  troop 
leaders  and  parents  need  to  share  informa¬ 
tion  about  projects  and  activities.The  council 
staff  members  need  to  communicate  with 
each  other  and  to  the  volunteers  about  ser¬ 
vices,  events  and  other  things.The  council 
provides  information  to  the  general  public  to 
recruit  new  members  and  volunteers  and 
conducts  fund  raising.The  list  of  who  needs 
to  communicate  what  to  whom  is  almost  end¬ 
less.  The  GSSJC  IT  Committee  is  investigating 
Microsoft  Office  ShareFbint  Server  2007  to  see 
if  this  product  can  be  the  council’s  communi¬ 
cation  platform  now  and  well  into  the  future. 
www.nwdocfinder.com/5035 
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DNS  CHANGE  MAKERS 


I  designed  the  foundations  of  DNS  25  years  ago  to  be  simple  and  modular. 
That’s  how  dozens  of  extensions  have  been  successfully  added  over  the  years  to,  for  example, 
integrate  DNS  with  DHCP,  route  VOIP  calls,  lookup  RFID  tags,  and  use  international  character  sets.  All  aspects 
of  the  DNS  are  larger  now.  The  email  that  needed  one  DNS  lookup  in  1983  now  needs  dozens  for  delivery  and 

spam  checking  -  not  to  mention  a  billion  or  so  new  public  and  private  domain  names. 

But  don’t  let  this  seeming  complexity  get  you  down. 


The  first  key  for  dealing  with  this  challenge  is  to  select  tools  that  have  been  tested, 
proven  and  use  the  same  simple  and  modular  approach.  That  way,  effort  in  one 
application  helps  another.  At  Nominum,  we  tested  our  ENUM  servers  to  be 
sure  that  they  could  handle  DNS  databases  that  had  millions  of 
separate  zones  and  billions  of  resource  records  and  still 
deliver  instant  server  restarts  and  still  deliver  industry-leading 
performance.  That  meant  that  when  a  huge  antispam 
database  application  came  our  way  we  knew 
there  was  no  scaling  issue. 


The  second  key  is  to  use  the  advanced  technology  to 
monitor  and  control  your  DNS  (and  DHCP)  systems. 

You  shouldn’t  expect  your  sysadmins  to  validate 
security  credentials  by  hand  or  learn  new  languages 
when  your  business  goes  international.  Human  error  is 
always  a  concern.  DNSStuff  uses  its  own  dedicated 
network  assets  to  monitor  your  DNS  systems  at  a  level 
of  detail  unmatched  by  other  tools,  then  it  uses  its 
proprietary  algorithms  to  give  you  the  most  specific 
results  and  actions  to  fix  any  problems.  When  new  DNS 
applications  and  extensions  are  added,  DNSStuff  tools 
are  there.  Not  all  DNS  tools  are  created  equal. 


Paul  Mockapetris,  Father  of  DNS,  invented  1983 


il  DNSstuff.com 


WHEN  GOOD  ISN’T  GOOD  ENOUGH. 


NETWORKWORLD.COM 


Follow  these  links  to  more  resources  online 


Ahead  of 
rootkit  talk, 
Cisco  patches 
router  flaw 

Cisco  last  week  issued  three  security  patches, 
fixing  bugs  that  could  crash  its  products  and 
drawing  a  warning  from  the  SANS  Internet 
Storm  Center. The  updates  fix  denial-of-ser- 
vice  bugs  in  the  Secure  Shell  software  in 
Ciscos  IOS,  used  to  power  its  routers;  and  in 
the  Cisco  Service  Control  Engine,  which  pro¬ 
vides  carrier-grade  networking  services.  Cisco 
also  patched  a  privilege-escalation  vulnerabil¬ 
ity  in  its  Voice  Portal  automated  customer  ser¬ 
vice  software.  In  its  security  advisories,  Cisco 
said  all  the  bugs  had  been  discovered  by  its 
own  researchers,  but  SANS  warned  that  re¬ 
searchers  probably  are  reverse-engineering 
the  patches  and  may  release  exploit  code 
publicly  www.nwdocfinder.com/5049 

WAN-optimization  box  hits  IGbps.  Silver 
Peak  Systems  is  introducing  a  IGbps  version 
of  its  WAN-optimization  box  geared  to  high- 
volume  data-center-to-data-center  traffic  or  to 
central  sites  that  optimize  traffic  to  multiple 
branches.The  NX-9000  has  two  lOGbps  physi¬ 
cal  WAN  ports  that  each  support  IGbps  opti¬ 
mized  throughput, and  four  IGbps  ports  that 
serve  as  LAN  connections.The  device  sup¬ 
ports  more  than  250,000  simultaneous  TCP 
flows,  as  well  as  disk  and  wire-speed  encryp¬ 
tion.  Competitor  Riverbed  Technology  s  WAN- 
optimization  gear  tops  out  at  800Mbps  for  a 
single  box  but  can  be  clustered  for  a  total 
speed  of  4Gbps.  Cisco  says  its  WAN-optimiza 
tion  WAE  7371  gear  has  a  throughput  of 
IGbps  www.nwdocfinder.com/5050 

Study:  Managed  services  booming. 

Consulting  firm  Ovum  last  week  released  a 
study  projecting  that  the  global  market  for 
managed  services  will  deliver  $66  billion  in 
revenue  by  2012. The  study,  which  collected 
data  from  more  than  1 ,300  users  of  enterprise 
managed  services  in  14  countries,  projects 
that  managed  IP-based  services  will  see  a 
compound  annual  growth  rate  of  18%  over 
the  next  four  years.  Overall,  the  study  finds 
that  the  managed  services  generating  the 
most  interest  among  corporate  users  are 
managed  metro  Ethernet,  managed  IP  VPNs, 
managed  VoIP  and  managed  security  Among 
these, VoIP  services  will  experience  the  fastest 
growth  over  the  next  four  years  with  a  39% 
CAGR.The  study  was  commissioned  by  Cisco. 
www.nwdocfinder.com/5051 


Companies  love  open  source 
but  need  help  with  it 


Open  source  icon  Stormy  Peters  recently 
joined  us  for  a  live  Network  World  chat. 

Peters  is  co-founder  of  the  non-profit 
GNOME  Foundation  and  director  of  com¬ 
munity  and  partner  programs  for  Open- 
Logic.  For  a  complete  transcript,  go  to 
wwuj.  networkworld.  com/ chat/. 

GoldNugget:  How  can  a  non-programmer  contribute  to  GN0MEP 

Non-programmers  are  needed  —  and  welcome  —  on  most  open 
source  software  projects.The  most  obvious  way  is  as  active  users  — 
using,  testing  and  submitting  any  issues.  Documentation  is  also  usu¬ 
ally  the  most  sought  after.  As  a  non-programmer  looking  to  get  in¬ 
volved  in  open  source,  the  first  few  things  you  should  do  are  down¬ 
load  and  use  the  software,  join  the  mailing  list,  and  let  people  know 
you  are  available  to  help. 

@rohanpinto:  Where’s  the  money  in  open  source? 

It  depends  on  who  you  are.  If  you  are  an  enterprise,  the  money  in  open  source  is  lower 
total  cost  of  ownership  (not  just  initial  costs),  more  choice,  better  developer  retention 
(developers  like  open  source). ...  If  you  are  an  open  source  company  . .  .well,  most  of 
them  at  the  moment  make  money  off  support  and  services.  If  you’re  a  developer, you 
can  make  money  by  finding  a  job  working  on  open  source  for  a  company  Or  you  can 
start  your  own  company 

gbellcolorado:  What  kinds  of  help  do  enterprises  typically  need  as  they  begin  to 
use  more  open  source? 

At  OpenLogic  we  usually  get  a  couple  of  different  types  of  calls.  Sometimes  people 
need  help  convincing  their  management.  Sometimes  they  need  help  developing  poli¬ 
cies.  Sometimes  they  need  support  for  a  particular  open  source  software  project.  We  get 
a  lot  of  calls  for  support  for  projects  where  official  enterprise  support  is  not  available. 

@rohanpinto:  When  organizations  announce  that  they  are  open  sourcing  a  prod¬ 
uct,  the  trend  is  that  they  open  source  it,  then  roll  the  contributions  from  the 
community  into  their  own  product.  Is  this  commercialization  of  open  source 
products  a  de  facto  standard  that  only  the  big  companies  can  adopt? 

Not  at  all.  I  think  commercialization  usually  means  that  there’s  a  number  that  enterprises 
can  call  for  help.  1  think  you  could  create  that  type  of  commercialization  for  any  of  the 
open  source  software-development  models. 

JamesRoth:  It  seems  like  there's  resistance  to  open  source  solutions  because  of 
perceptions  that  open  source  means  more  difficulty  to  manage,  fewer  techs  and 
engineers  know  it.  Thoughts? 

One  of  the  big  strengths  and  perceived 
weaknesses  of  open  source  is  its  modu¬ 
larity  It’s  easy  to  customize  solutions, 
integrate  them  into  your  environment, 
etc.  But  when  something  goes  wrong, 
enterprises  are  faced  with  figuring  out 
which  component  is  responsible.  It’s  just 
a  new  model  and  that  the  strength  of 
modular  solutions  outweighs  the  “pain” 
of  having  lots  of  components.  ■ 


ONLINE:  Join  our  next  chat 

Talk  with  authors  Markus  Jakobsson 
and  Zullfikar  Ramzan  on  May  28  at 
2  p.m.  EDT  about  crimeware:  under¬ 
standing  new  attacks  and  defenses. 

www.networkworld.com/chat 
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Feds  encrypt  800,000  laptops 


BY  CAROLYN  DUFFY  MARSAN 

In  the  last  year,  agencies  have  purchased 
800,000  licenses  for  encryption  software 
through  the  federal  Data  at  Rest  Encryption 
program,  which  is  run  jointly  by  the  General 
Services  Administration  and  the  U.S.  Depart¬ 
ment  of  Defense. 

“Sales  have  been  very  brisk,”  says  Fred 
Schobert,CTO  for  integrated  technology  ser¬ 
vices  at  the  General  Services  Administration’s 
Federal  Acquisition  Service.“We’ve  been  some¬ 
what  overwhelmed.” 

The  fast  adoption  of  encryption  software 
comes  after  numerous  headline-grabbing  secu¬ 
rity  breaches.  Laptop  encryption  has  also  been 
on  the  rise  among  corporations. 

It’s  been  two  years  since  teens  stole  a  laptop 
from  the  home  of  a  U.S.  Department  of 
Veterans’  Affairs  employee’s  home,  putting  at 
risk  for  identity  theft  a  database  of  26.5  million 
names  and  Social  Security  numbers  for  26.5 
million  veterans  and  military  personnel. 

But  this  year  alone,  laptops  with  personally 
identifiable  information  have  been  stolen  from 
Bolling  Air  Force  Base,  a  Marine  Corps  base  in 
Okinawa,  Japan  and  the  National  Institutes  of 
Health  in  Bethesda,  Md.  In  all  of  these  cases, 
data  that  wasn’t  encrypted  on  these  laptops 
could  have  been  used  by  thieves  for  identity 
theft,  according  to  the  Privacy  Rights  Web  site. 


What  encryption  soft¬ 
ware  feds  are  buying 

The  federal  Data  at  Rest 
Encryption  contract  offers: 

Credant  Mobile  Guardian  from 
Credant  Technologies 

Data  Armor  from  Mobile  Armor 

GuardianEdge  from  GuardianEdge 
Technologies 

Pointsec  from  Check  Point  Software 

Safeboot  Device  Encryption  from 
McAfee 

SafeNet  ProtectDrive  from  SafeNet 

Secret  Agent  from  Information 
Security 

SecureDoc  from  WinMagic 
DS  Data  Security  Suite  from  Spyrus 
SecureDoc  from  WinMagic 

Skylock  At-Rest  from  Encryption 
Solutions 

Talisman  from  Spyrus 


While  sales  on  the  DAR  Encryption  program 
are  stronger  than  anticipated,  federal  officials 
admit  they  haven’t  secured  all  of  their  laptops, 
handhelds  and  removable  drives  yet. 

“It  was  originally  thought  that  there  would  be 
about  1  million  laptops  in  DoD  and  1  million  in 
civilian  agencies.  We  roughly  came  up  with  the 
number  of  2  million  laptops.  However  that 
number  is  informal,”  says  David  Hollis,  program 
manager  for  the  Defense  Department’s  Data  at 
Rest  Tiger  Team. 

“We’re  not  worrying  about  how  many  laptops 
and  PDAs  there  are  in  the  government.  We’re 
trying  to  provide  an  opportunity  for  federal, 
state  and  local  governments  to  secure  what’s 
out  there,”  Hollis  said. 

The  Office  of  Management  and  Budget  re¬ 
quires  federal  agencies  to  purchase  encryption 
software  for  laptops,  handhelds  and  removable 
storage  devices. 

The  DAR  program,  which  offers  encryption 
software  from  10  vendors,  “is  really  one  of  the 
cornerstones  of  security  information  assur¬ 
ance  overall  in  terms  of  the  U.S.  government,” 
says  Robert  Lentz,  deputy  assistant  secretary  for 
Information  and  Identity  Assurance  at  the 
Defense  Department. 

One  reason  the  federal  government  is  buying 
encryption  software  is  that  the  prices  are  so 
low.  On  the  DAR  Encryption  program,  the  gov¬ 
ernment  is  paying  only  $10  to  $12  per  laptop 
for  software  that  retails  at  $125  or  more. 

“The  federal  IT  budget  alone  is  around  $70 
billion.  When  you  think  about  the  scale  of  that 
budget,  $12  a  laptop  is  pretty  cheap  insurance” 
says  Ray  Bjorklund, senior  vice  president  of  Fed 
Sources,  a  market  research  firm. 

Federal  officials  say  they  have  sold  $17  mil¬ 
lion  worth  of  encryption  software  through  the 
DAR  program  to  date.  More  significant,  they  say 
are  the  total  savings. 

“The  discounts  we  have  achieved  have  re¬ 
sulted  in  a  total  cost  avoidance  of  $79  million,” 
Schobert  said. 

Federal  officials  say  they  are  getting  a  dis¬ 
count  of  more  than  80%  off  retail  pricing  for  en¬ 
cryption  software. 

So  far,  76%  of  sales  from  the  DAR  Encryption 
contracts  have  been  from  federal  agencies, 
while  24%  have  been  from  state  and  local  gov¬ 
ernment  agencies.“Our  largest  purchases  were 
made  by  Agriculture,  IRS, Transportation,  Army 
and  Social  Security  Administration,”  Schobert 
says.  “Thirty  state  and  local  government  agen¬ 
cies  have  purchased  off  the  DAR  [contracts] .” 

“From  the  DOD  standpoint,  it’s  mandatory?’ 
Lentz  says.“We  have  made  it  clear  to  the  depart¬ 
ment  after  this  award  occurred  that  we  wanted 
to  have  all  crucial  mobile  devices  using  this 
technology  by  the  end  of  the  year” 

Encryption  of  mobile  data  is  a  serious  issue 
for  government  agencies,  Bjorklund  says. “As 
the  wireless  technology  becomes  more  robust 


and  more  reliable,  there  is  a  strong  likelihood  it 
can  be  used  for  critical  command-and-control- 
type  applications,  and  that’s  where  the  need  for 
security  becomes  very  very  high”  he  says. 

GSA  said  the  five-year  DAR  Encryption  con¬ 
tracts  could  be  worth  more  than  $79  million. 

“There  is  an  opportunity  for  significant  sales 
ahead,”  Schobert  says.“The  first  year,  we  were  in 
start-up  mode.” 

The  most  popular  products  on  the  DAR  En¬ 
cryption  program  are  hybrid  packages  that 
offer  full  disk  and  file  folder  encryption. 

“The  larger  organizations  want  to  buy  one 
software  product.  They  want  full-disk  encryp¬ 
tion  on  their  laptops,  but  they  also  want  it  on 
their  workstations  to  encrypt  the  files  they  put 
on  removable  storage  devices,”  Hollis  says.  ■ 


InBrief 


Open  source  DNS  server 
released 

A  group  of  experts  unveiled  an  open 
source  alternative  to  the  BIND  DNS  server 
software  that  offers  higher  performance 
and  better  security.The  new  DNS  server 
—  dubbed  Unbound  1.0  —  is  a  recursive 
DNS  server,  which  is  used  by  ISPs  and 
enterprises  to  support  DNS  look-ups  by 
users.  It  was  released  last  week  to  open 
source  developers  by  NLnet  Labs,  VeriSign, 
Nominet  and  Kirei.  From  its  first  prototype 
in  2004,  Unbound  was  designed  to  be  a 
faster,  more  secure  replacement  for  BIND. 
Unbound  supports  DNS  security  exten¬ 
sions,  which  authenticate  DNS  lookups  but 
are  not  widely  deployed  yet  because  they 
rely  on  a  public  key  infrastructure. 

AT&T  3G  network  nearly 
complete 

AT&T  is  on  track  to  complete  its  3G  mobile 
broadband  network  by  the  end  of  June,  thus 
becoming  the  first  U.S.  carrier  to  fully  de¬ 
ploy  High-Speed  Packet  Access  technology 
over  its  network.  HSPA  is  a  mobile  broad¬ 
band  technology  comprising  two  wireless 
broadband  protocols,  known  as  High  Speed 
Downlink  Packet  Access  and  High  Speed 
Uplink  Packet  Access,  that  operate  on  3G 
mobile  devices.  AT&T’s  HSPA  network 
delivers  data  download  speeds  as  fast  as 
1.4Mbps  and  upload  speeds  as  fast  as 
800Kbps.  AT&T's  HSPA  services  are  avail¬ 
able  in  around  275  markets  in  the  United 
States,  and  the  company  says  they  will  be 
available  in  350  U.S.  markets  by  year-end. 
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:  Microsoft 


aking  on  dragons,  easy. 


1.  Put  the  fire  out 

Knowing  what  to  do  if  there's  a  fire  is  always  smart. 
That  the  fire  spews  from  the  mouth  of  a  ferocious 
flying  serpent  should  make  no  difference. 


2.  Give  them  what  they  want 

Dragons  desire  gold,  jewels,  and  princesses.  Have  any  treasure  around? 

A  nice  watch,  petty  cash,  your  silver  sales  award?  More  on  princesses  later. 


3.  Use  the  shrink  spell. 

Arthurian  legend  tells  of  the  wizard  Merlin,  who  would  have  known 
how  to  shrink  an  unruly  dragon.  Magic  wand  and  spells  not  included 


Ask  for  a  break. 

Searing  heat,  slashing  claws,  and  the  beating 
hell  will  tire  anyone.  Say  you  need  a  break,  th 
quickly  out  the  back. 


5.  The  princess  defense. 

That  temp  in  finance— bewigged,  begowned,  and  pushed  Dragon 
ward — may  just  pass  for  a  princess. 

6.  Dragonslayer. 

You  learn  to  slay  Dragons  by  slaying  Dragons.  Win  this  one  and  you'll 
be  an  in-demand  consultant  to  other  Dragon-besieged  companies. 


.<? 


taking  on  security  threats,  easier. 


1.  Implement  Microsoft5  Forefront" 

Forefront  makes  defending  your  systems  easier,  it's  a  comprehensive,  simple- 
to-use,  integrated  family  of  products  that  helps  provide  protection  across  your 
client,  server,  and  network  edge.  Learn  how  Del  Monte  Foods  uses  the  Forefront 
family  of  products  to  help  defend  their  systems.  Visit  easyeasier.com 

Forefront  is  business  security  software  for  client,  server,  and  the  network  edge. 
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10G  Ethernet  powers  glitzy  casino 

VoIP,  wireless  still  need  to  prove  themselves  to  CTO  at  the  Venetian 


BY  JIM  DUFFY 

LAS  VEGAS -The  $1.5  billion  Venetian  resort 
in  Las  Vegas  is  a  city  within  a  city 

It  boasts  7,000  guestrooms  in  three  towers,  a 
120,000-square-foot  casino,  waterways,  gondo¬ 
las,  frescoes,  a  convention  center,  retail  shops, 
a  bank,  18  world-class  restaurants,  its  own 
police  force  —  even  a  TV  station. 

Throw  in  4,000  cameras —  1,200  for  security 
and  surveillance  —  wireless  hot  spots,  and 
back-office  operations  such  as  inventory  con¬ 
trol  and  purchasing,  and  it’s  a  tall  order  for  any 
network  to  handle.  But  a  700-switch,  10G  Ether¬ 
net  infrastructure  split  into  98  virtual  LANs 
(VLAN)  is  keeping  up  just  fine,  according  to 
the  resort’s  IT  staff. 

The  network  is  running  Venetian’s  entire 
business  —  casino,  convention  center,  retail, 
multiple  restaurants,  VoIP  and  guest  services 
operations,  including  registration  and  check¬ 
out,  cable  TV,  and  wired  and  wireless  Internet 
access.  Despite  this  heavy  lifting,  the  network  is 
not  overly  sophisticated  —  it’s  been  in  place 
since  the  resort  was  constructed  10  years  ago 
and  was  selected  based  on  its  simplified  oper¬ 
ation  and  management  (see  diagram). 

“Our  [network]  is  straightforward,  easy  to 
manage  and  requires  minimal  support,”  said 


Steve  Vollmer,  vice  president  of  IT  and  CTO  of 
Las  Vegas  Sands  Corp.“We  estimate  [it]  helps 
us  save  10  to  15  seconds  during  guest  check-in 
and  checkout,  which  translates  to  a  savings  of 
nearly  30  hours  a  day  just  in  one  department.” 

Switch  setup 

The  10G  Ethernet  core  of  the  Venetian  net¬ 
work  is  made  up  of  HP  ProCurve  8200  and 
5400  series  switches.  Five  8200s  are  configured 
in  a  simple  mesh  in  one  of  the  resort’s  towers 
to  provide  path  resiliency  and  redundancy 

“It  will  take  a  full  hit  anywhere  and  it  just 
keeps  on  marching,”Vollmer  says  of  the  net¬ 
work  core. 

Four  5400  switches  make  up  a  smaller  core 
in  the  newest  Venetian  tower,  the  Palazzo.  The 
Palazzo  alone  has  3,000  guestrooms. The  core 
is  running  at  20%  utilization, Vollmer  says. 

The  core  switches  take  in  Gigabit  Ethernet 
links  from  HP  ProCurve  4000  switches  aggre¬ 
gating  100Mbps  Ethenet  feeds  from  ProCurve 
3500  switches  in  the  wiring  closets.  The  3500 
switches,  meanwhile,  are  providing  100Mbps 
bandwidth  to  4,000  slot  machines  on  the  casi¬ 
no  floor,  guest  registration  systems,  point-of- 
sale  systems  in  restaurants  and  retail  stores, 
ATMs,  digital  video  signage  and  cameras,  gue¬ 


strooms,  lobby  music,  VoIP  handsets  and 
switches,  and  virtually  everything  to  do  with 
resort  operations. 

In  all,  the  converged  network  supports 
65,000  devices  —  including  180  virtual 
servers,  7,000  printers  and  14,000  Teleadapt 
devices  in  guestrooms  that  provide  wired 
Ethernet  and  IEEE  802.1  lb  wireless  Internet 
access. 

The  98  VLANs  are  configured  according  to 
application:The  front  desk  windows  are  all  on 
different  VLANs,  and  there  are  separate  VLANs 
forVoiPcameras,  signs,  Internet  access  by  floor, 
point-of-sale,  cage  operations  and  so  on.  The 
network  employs  IEEE  802. Ip  and  q  to  pro¬ 
vide  quality-of-service  based  on  applications 
and  traffic  type. 

Surveillance  and  security  cameras  are  phys¬ 
ically  segmented  on  their  own  switched  Ether¬ 
net  network,  Vollmer  says. 

Questioning  VoIP,  wireless 

Only  2,000  of  the  resort’s  more  than  20,000 
phones  are  VoipVollmer  says,  and  they  and  the 
wireless  access  points  are  connected  to  the 
switches  using  Power  over  Ethernet.Venetian  is 
still  kicking  the  tires  with  VoIP  looking  for  that 
elusive  benefit  that  will  justify  the  cost  —  $125 
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Network  jackpot 

The  Venetian  resort  divides  its  high-speed  Ethernet  network  into  98  virtual  LANs  (VLAN), 
a  sampling  of  which  are  shown  below  for  various  applications  and  operations. 
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per  IP  phone  vs.  $20  or  less  for  a  traditional 
TDM  phone. 

“It’s  hard  to  justify  VoIP  in  the  rooms,”  he  says. 
“We’re  waiting  for  that  killer  app.” 

Likewise,  wireless  is  appropriate  for  some 
applications  but  not  others.  In  addition  to 
802.1  lb  in  every  room  for  Internet  access,  the 
Venetian  has  802.1  lg  on  the  resort’s  main 
floor  to  help  support  front  desk  and  casino 
operations. 

The  Venetian  tried  deploying  portable  “roll-a- 
desks”that  can  be  moved  to  different  locations 
to  expedite  large  group  check-in  or  checkout. 
But  they  proved  inefficient  and  cumbersome 


Next-generation  WAN  services 
event 

Enterprises  face  an  increasingly  com¬ 
plicated  network-services  landscape. 
Today’s  Ethernet  options  offer  new 
managed  services,  greater  simplicity, 
higher  bandwidth  and  reduced  costs. 
But  they  come  at  a  price:  A  whole  new 
set  of  service  delivery  complexities. 
Learn  about  advanced  communications 
services:  Where  are  we  now?  Where 
are  we  headed  tomorrow?  Attend  IT 
Roadmap:  Atlanta,  July  16. 

www.nwdocfinder.com/4541 


compared  with  just  opening  up  another  win¬ 
dow  at  the  registration  desk. 

“Wireless  is  disappointing  to  us,”Vollmer  says 
of  the  portable  desk  experience.“What  do  you 
do  with  it?” 

The  switches  are  integrated  with  virus  pro¬ 
tection  but  they  can  also  detect  suspicious 
guest  activity. The  Venetian  recently  hosted  a 
Defcon  hacker  conference  and  the  network 
thwarted  attempts  by  conference  attendees  to 
infiltrate  the  Venetian  network. 

The  resort  also  hosted  a  conference  of  com¬ 
panies  in  the  adult  entertainment  industry  and 
had  to  deflect  attempts  by  some  attendees  to 
send  out  spam  from  their  guestrooms. 

“They’re  more  of  a  pain  in  the  [backside] 
than  Defcon,”  Vollmer  says  of  the  adult  enter¬ 
tainment  attendees. 

In  both  cases,  the  Venetian  network  alerted 
Vollmer  and  other  IT  officials  to  unusually 
high  bandwidth  usage.  Then  the  Venetian’s 
ISP  noted  a  slew  of  hits  against  its  DNS 
servers  coming  from  the  resort.  The  ISP 
handed  over  the  IP  addresses  of  the  perpe¬ 
trators  to  the  Venetian  and  the  room-to-room 
roundup  began. 

The  next  steps  for  the  Venetian  are  to  install  a 
fifth  HP  ProCurve  5400  switch  to  strengthen  its 
DMZ  zones,  and  provide  redundancy  and  load 
balancing. The  resort  plans  to  install  two  more 
ProCurve  3500  switches  to  replace  a  Cisco 
7206  router  for  part  of  the  DMZ. 

The  router  was  a  single  point  of  breakdown, 
Vollmer  says. 


The  Venetian  may  also  replace  the  ProCurve 
4000  series  switches  that  have  been  in  place 
for  10  years  with  5400  switches.  The  replace¬ 
ment  has  more  to  do  with  keeping  the  net¬ 
work  up  to  date  than  it  does  with  the  older 
switch  wearing  out. 

“They  don’t  break,”  Vollmer  says,  jokingly 
adding, “it’s  flawed  because  we  can’t  get  noth¬ 
ing  new?’ 

The  only  hiccups  in  the  last  decade  were 
loops  that  would  occur  when  new  offices  were 
added  to  the  network. 

“Only  outages  we  ever  had  were  moments  of 
interruption, ’’Vollmer  says.“Our  biggest  fear  is  a 
loopback.” 

The  deployment  here  is  being  mirrored  in 
Macao,  where  Sands  just  opened  up  the 
Venetian  Macao.  The  ProCurve  switches  in 
that  network  outnumber  those  in  the  Las 
Vegas  resort. 

But  rather  than  disclose  how  much  Sands 
invested  in  the  two  networks, Vollmer  prefers  to 
discuss  payback.  He  expects  the  Macao  net¬ 
work  to  save  him  $5  million  in  five  years. 

“It’s  a  TCO  thing, ’’Vollmer  says.“They  got  to  be 
able  to  do  the  job.  We’re  past  the  reliability  [re¬ 
quirement].  We’ll  look  at  it  in  five  years.”  ■ 
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Support,  monitor  and  train  your  users  securely.  Manage  and  monitor  multiple  systems  simultaneous¬ 
ly  with  NSM's  multi-platform  support  including  Windows,  Linux,  MAC,  Solaris,  and  Windows  Mobile. 
Troubleshoot  help  requests  efficiently  with  NSM's  inventory  and  desktop  management  tools. 

Take  control  of  your  network  before  it  controls  you. 
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MANAGER 

www.netsupportmanager.com 


Maximum  Control.  Minimum  Effort. 


Providing  desktop  support  can  be  a  headache  with  the  number  of  systems,  servers  and  mobile  devic¬ 
es  located  on  today's  network.  With  NetSupport  Manager  remote  control  software,  you  can  provide  IT 
support  centrally  from  one  location,  improving  response  times  and  reducing  associated  IT  costs. 


SPECIAL  FOCUS:  SECURITY  IN  THE  LABORATORY 


Wireless  confidential 

Lab  offers  view  of  commercial,  military  wireless  security  threats 


BY  BRAD  REED 

Jason  Crawford  has  learned  that  if  you  want  to  break  into  secure 
Wi-Fi  networks,  you  don’t  need  to  buy  equipment  from  the  black 
market.  Instead,  you  can  buy  it  from  Toys  “R”  Us,  he  says. 


Crawford,  who  works  as  a  principal  investi¬ 
gator  for  R&D  projects  at  Lockheed  Martins 
newly  opened  wireless-security  laboratory 
says  he  has  figured  out  how  to  crack  the 
seemingly  secure  wireless  networks  that 
consumers  and  corporations  use  —  with 
nothing  more  than  a  cluster  of  eight 
PlayStation  3s.  Crawford  won’t  go  into  the 


Here’s  a  quick  peek  at  what 

Lockheed  Martin  is  working  on  in 
its  wireless  security  lab: 
CyberDefense  R&D  project.  ‘‘An 
ongoing  R&D  effort  integrates  com¬ 
mand,  control  and  battle-management 
applications  into  a  cyberdefense  envi- 
ronment.The  project  also  models  vul¬ 
nerabilities  in  such  dense-signal  envi¬ 
ronments  as  cities,  helping  operators 
better  plan  and  orchestrate  defenses  in 
advance  of  a  cyberattack  and  in  real 
time  during  an  attack. The  goal  is  to 
evaluate  a  suite  of  tools  that  cyberoffi¬ 
cials  can  use  to  coordinate  defenses 
across  agencies,  departments  and  geo¬ 
graphic  boundaries.” 

Commercial  intrusion-detection  eval¬ 
uation.  ‘‘On  behalf  of  a  government 
customer,  we  conducted  an  evaluation 
of  various  wireless  intrusion-detection 
applications  and  measurement  devices 
from  commercial  industry.  We  then 
made  recommendations  to  the  govern¬ 
ment  on  implementation  and  integration 
of  these  tools  that  would  create  the 
strongest  defense  against  potential 
wireless  intrusion.” 

Deployed  802.11  wireless  vulnerability 
assessment.  ‘‘We  conducted  an  exten- 


details  of  how  he  used  the  PS  3s  to  hack  Wi¬ 
Fi  networks,  but  he  says  that  you  don’t  have 
to  be  a  top-level  hacker  to  figure  it  out. 

“The  PS  3s  use  a  processor  called  the  Cell 
Broadband  Engine,  and  it’s  so  insanely  fast 
that  it  didn’t  take  long  for  us  to  crack  [Wi-Fi 
Protected  Access]  networks  once  we  start¬ 
ed  writing  some  software  for  it,”  Crawford 


sive  assessment  of  a  deployed  802.11 
wireless  network  for  a  government  cus¬ 
tomer,  helping  them  optimize  their 
security  architecture  and  practices 
before  the  network  went  ‘live.’ Working 
with  a  model  of  the  network  and  nodes 
integrated  with  our  wireless  lab,  we 
determined  potential  and  likely  attack 
vectors,  evaluated  vulnerabilities,  mod¬ 
eled  a  variety  of  attacks,  and  devised 
strategies  and  improvements  for 
improving  defenses." 

Fastcrack  R&D  project:  “One  of  our 
strategies  with  the  lab  is  to  model 
potential  new  and  emerging  cyber¬ 
attack  techniques,  so  that  we  can  bet¬ 
ter  prepare  and  test  defensive  strate¬ 
gies  and  technologies.  Under  the 
Fastcrack  research  and  development 
effort,  we  created  a  cheap,  portable 
device  that  can  quickly  crack  standard 
Wired  Equivalent  Privacy  encryption 
on  802.11  networks. The  device  uses 
powerful  processors  from  a  popular 
video-game  console  —  which  are  both 
readily  available  and  low-cost  —  to 
rapidly  conduct  the  extensive  compu¬ 
tations  required  to  crack  network 
encryption.” 


says.“I  set  up  a  cluster  of  about  eight  PS  3s. 
.  .  .  Getting  them  together  wasn’t  all  that 
expensive.” 

Crawford’s  PlayStation  hack  is  just  one  of 
many  projects  that  Lockheed  Martin 
researchers  are  working  on  to  head  off  the 
dangers  of  technological  surprise.  In  other 
words,  the  brains  at  the  company  are  in  a 
race  to  discover  the  loopholes  and  faults  in 
wireless  security  before  terrorists  and  cyber 
criminals  do.  This  requires  a  tremendous 
amount  of  outside-the-box  thinking,  says 
John  Morrison,  chief  of  the  company’s 
Wireless  Cyber  Security  Lab. 

“The  9/11  Commission  said  that  one  of 
the  biggest  reasons  that  the  government 
failed  to  prevent  the  9/1 1  attack  was  a  fail¬ 
ure  of  imagination,”  Morrison  says.  “We’re 
trying  to  ensure  that  something  similar 
doesn’t  happen  in  the  realm  of  wireless 
communications.” 

Defining  the  problem 

So,  just  what  are  the  biggest  emerging 
threats  in  wireless  security?  Perri  Nejib,  CTO 
for  Lockheed  Martin  Information  Systems, 
says  her  biggest  concern  has  been  the  grad¬ 
ual  migration  of  the  office  to  the  home.  As 
workers  increasingly  connect  to  company 
data  through  corporate  VPNs  from  their 
homes,  companies  have  less  control  over 
where  their  employees  can  gain  access  to 
sensitive  information. 

“The  lines  between  our  work  environment 
and  our  home  environment  are  becoming 
increasingly  blurred  as  wireless  routers, 
phones  and  aircards  rapidly  extend  the  tra¬ 
ditional  office  enterprise  further  and  further 
to  the  edge,”  Nejib  says.  “The  network  now 
moves  with  the  individual  to  their  living 
room,  hotel  room,  car  and  coffee  shop.... This 
is  both  exciting  and  challenging  for  us.” 

To  that  end,  Lockheed  Martin  has  been 
running  tests  on  many  types  of  consumer 
technology  that  have  been  migrating  to 
enterprise  networks,  including  Wi-Fi,  WiMAX, 
Bluetooth  and  cell  phones.  The  abundance 
of  Wi-Fi  hot  spots  is  one  of  the  lab’s  most 
pressing  concerns  because  Wi-Fi  increasing¬ 
ly  has  become  ubiquitous  in  urban  areas 
and  users  can  connect  to  unsecured  net¬ 
works  and  not  realize  that  they’re  at  risk.  The 
major  issues  with  Wi-Fi  include  “connection 
hijacking,  deliberate  or  inadvertent  denial  of 
service,  the  creation  of  security  holes  in  cor¬ 
porate  or  government  networks,  and  difficul- 
See  Lockheed  Martin,  page  38 
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What’s  in  Lockheed’s 
wireless  security  labP 
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With  wildly  popular  destination  stores  and  120  million  catalogs  mailed  yearly,  Cabela’s,  the  world’s  foremost  outfitter  of 
hunting,  fishing,  and  outdoor  gear,  requires  a  steadfast  network  provider  to  service  its  loyal  customers.  Enter  the  superior 
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And  in  the  case  of  IT  big  gun  Nick  Stafford,  our  “buck  stops  here”  attitude  may  be  his  rarest  trophy  of  all. 
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CIOs  look  beyond  Web  2.0 

At  MIT  symposium  CIOs  examine  impact  of  advanced  technology 


BY  JOHN  COX 

“Web  2.0  is  a  thing  of  the  past.” 

That  was  the  judgment  of  Maria  Pardee,  pres¬ 
ident  of  global  integration  for  BT  Design,  the  IT 
design  and  delivery  arm  of  British  Telecom¬ 
munications  (BT), speaking  at  the  fifth  annual 
Massachusetts  Institute  of  Technology  CIO 
Symposium  last  week. 

She  wasn’t  just  being  provocative:  Her  col¬ 
leagues  on  the  panel  pretty  much  agreed  with 
her.“The  future  is  about  how  to  exchange  data, 
and  have  trusted  relationships,  with  people 
outside  the  enterprise,”  she  said. 

The  MIT  panel  was  organized  to  wrestle  with 
the  emergence  of  a  basket  of  very  diverse 
technologies,  all  grouped  under  the  “Web  2.0” 
label,  and  their  corporate  potential. 

The  technologies  range  from  Web  services 
and  standards  such  as  XML,  and  service-ori¬ 
ented  architectures  (SOA),to  wikis  and  RSS 
feeds,  to  new  forms  of  collaboration  and 
social  networking,  and  even  to  new  infrastruc¬ 
tures  to  support  all  this,  such  as  cloud  com- 

**Web  2.0  is  a 
thing  of  the 
past.55 

Maria  Pardee 

President  of  Global 
Integration,  BT  Design 
(part  of  British 
Telecommunications) 

puting  and  virtualization. One  analyst  firm  esti¬ 
mated  these  technologies  will  be  a  $4.6  billion 
market  in  2013. 

For  Pardee  and  her  colleagues  on  the  panel, 
many  of  these  technologies  have  already  be¬ 
come  an  essential  part  of  the  corporate  IT 
landscape.  The  explosion  of  social  network¬ 
ing  and  its  implications  for  organization  and 
business  processes,  such  as  customers  and 
supplier  relationships  is  evidence  that  the 
original  Web  2.0  has  begun  to  foster  new  ways 
of  doing  business. 

The  power  of  sharing 

“Web  2.0  [today]  is  about  applications  and 
systems  that  can  talk  with  each  other  and  col¬ 
laborate,”  said  Richard  Mickool,  executive 
director  and  CTO  for  Northeastern  University’s 
information  services  group.’The  real  power  is 
around  sharing  information  [dynamically  and 
automatically]  and  building  upon  it.” 

That  sharing  and  building  will  now  take 
place  at  a  higher  level  of  abstraction,  accord¬ 
ing  to  Mike  Willis,  a  consultant  with  Pricewater 
houseCoopers,  and  founding  chairman  of 
XBRL  International,  which  is  fostering  adop¬ 


tion  of  the  extensible  Business  Reporting 
Language,  a  Web  2.0  format  standard  to  sim¬ 
plify  the  reporting  of  business  financial  data. 

With  XBRL,  Willis  said,  analysts  of  capital 
markets  have  the  potential  to  do  much  more 
than  access  and  share  raw  data.  Instead,  they 
can  share  the  mathematical  financial  models 
that  work  with  the  data,  elaborating  and  iterat¬ 
ing  those  models  to  improve  them. “Web  2.0 
standardization  is  now  around  higher  level  IP 
[intellectual  property]  (Willis  said. 

James  Lin,  CIO  for  Forbes,  gave  an  example 
of  this  shift.  As  is  typical  for  online  news  sites, 
Forbes  lets  readers  comment  on  stories  and 
features  the  comments  on  the  home  page, 
along  with  different  rankings  of  news  and  con¬ 
tent,  by  users  and  Forbes  editors.  But  Forbes 
has  taken  user  content  a  step  further.  It  features 
a  members-only  community  of  stock  pickers. 
Members,  who  are  investors,  can  make  stock 
recommendations,  along  with  separate  picks 
by  Forbes  editors,  inviting  discussion  by  other 
members.Then,the  performance  of  the  stocks, 
and  of  the  members  recommending  them,  is 
tracked  and  ranked. 

Lin  predicted  that  personalization  of  con¬ 
tent  will  generate  greater  demand  for  per¬ 
sonalization  tools  —  capabilities  that  let  Web 
users  filter,  aggregate  and  format  data  that 
needs  their  specific  interests,  schedules  and 
even  locations. 

The  geek  factor? 

Perhaps  all  these  technologies  are  only 
accessible  to  the  enthusiasts,  the  geeks,  sug¬ 
gested  the  panel  moderator,  Andrew  McAfee, 
associate  professor  of  business  administration, 
Harvard  Business  School.  “XML  is  not  a  tech¬ 
nology  for  the  masses,” he  said. 

But  in  a  sense  it  is,  Willis  countered. “Tech¬ 
nologies  like  XBRL  are  embedded  in  some¬ 
thing  else,  like  [an]  Excel  [spreadsheet] ,”  he 
said.  “The  financial  analysts  are  just  using 
Excel.” 

Mickool  said  that  embedded  quality  poses  a 
special  challenge  for  the  enterprise. “We  need 
to  employ  these  technologies  because  our 
users  are  buying  devices  and  software  that 
already  have  them,  and  they  expect  to  be  able 
to  operate  on  our  infrastructure,”  he  said. 

Look  good  naked 

Mickool  said  organizations  need  to  realize 
that  what  McAfee  describes  is  introducing  a 
new  kind  of  transparency  to  organizations  and 
is  becoming  an  attribute  of  the  Web.“We  need 
and  want  this  kind  of  feedback,”  he  said. 

Willis  shared  a  favorite  quote  related  to 
McAfee’s  point,  from  author  Don  Tapscott  and 
David  Ticol  in  their  book  The  Naked  Cor¬ 
poration:  How  the  Age  of  Transparency  will 


«It’s  not  easy  to 
implement  Web 
2.0.  It’s  not  a 
panacea  for 
business 
problems.55 

James  Lin 

CIO,  Forbes.com 

Revolutionize  Business.  “If  you’re  going  to  be 
naked,  you  better  be  buff, ’’Willis  said. The  Web 
introduces  transparency  into  the  processes  of 
creating,  sharing  and  interpreting  information. 
The  days  of  a  special  class  of  experts  control¬ 
ling  a  one-way  flow  of  information  are  over,  he 
suggested. 

Forbes’  Lin  argued  that  experts,  such  as  edi¬ 
tors,  are  still  needed.“But  their  role  is  different,” 
he  said.  He  outlined  a  role  that  is  more  collab¬ 
orative,  more  communal  and  more  iterative. 
The  Forbes  Web  site  has  tools  for  allowing  self- 
proclaimed  experts  to  rate  and  comment  on 
stocks.  But  other  tools  track  the  stock’s  perfor¬ 
mance  over  time,  and  rate  the  effectiveness  of 
the  stock  pickers,  and  Forbes  editor  participate 
in  all  of  these. “Experts  need  to  operate  at  a 
higher  level,”  Lin  said. 

McAfee  noted  that  such  changes  were  blur¬ 
ring  the  boundaries  within  enterprises, and  be¬ 
tween  enterprises  and  groups  such  as  cus¬ 
tomers  and  suppliers  or  regulators.  “Don’t  we 
want  or  need  these  boundaries?”  he  asked. 

BT’s  Pardee  said  this  weakening  of  bound¬ 
aries  in  BT’s  case  paradoxically  means  that 
customers  put  greater  trust  in,  and  demand 
higher  performance  from,  the  telecom  giant  to 
provide  reliable  and  secure  networks.  And  it 
creates  new  business  opportunities.  “Access 
[to  the  network]  is  becoming  a  commodity  for 
BT7she  said.The  innovation  and  value  we  add 
lie  in  the  software  layers  on  top  of  that.” 

“Most  organizations  don’t  know  where  their 
boundaries  are,”  Willis  added.  If  you  receive 
some  set  of  data,  do  you  know  where  it  came 
from,  what  product  it’s  associated  with,  how 
current  it  is,  whether  or  to  what  degree  it’s 
accurate?  Web  2.0  standards  and  technologies 
can  address  these  issues  even  as  traditional 
boundaries  shift,  he  suggested. 

Questioners  pointed  to  problems  still  to  be 
addressed,  ranging  from  wikis  that  develop 
feudal  or  gang  mentalities  that  stifle  commu¬ 
nication  and  sharing,  to  maintaining  data 
quality  and  service  level  standards  in  fluid 
SOA  environments  that  rely  on  third-party  or 
external  software  components-^ 
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All  eyes  on  Microsoft’s  ODF  plan 

Adding  support  for  the  OpenDocument  Format  to  Office  2007 


Journey  to  a  standard 


Microsoft  first  began  dabbling  with  XML  in  file  formats  back  in  1998, 
and  a  decade  later  it  had  come  up  with  a  format  —  OpenOffice  XML 
(OOXML)  —  that  earned  standards  approval  by  the  International 
Standardization  Organization. 

1998  —  Microsoft  begins  to  dabble  with  XML  in  file  formats. 

2000  —  XML  file  format  for  Excel  released,  followed  by  one  for  Word  in  2001. 

May  2005  —  OpenDocument  vl.O  specification  approved  as  a  standard  by  the 
Organization  for  the  Advancement  of  Structured  Information  Standards;  Microsoft 
announces  default  XML  file  formats  forWord,  Excel,  PowerPoint. 

September  2005  —  Commonwealth  of  Massachusetts  announces  it  intends  to  ban 
use  of  Microsoft  Office  in  favor  of  software  that  supports  open  document  formats. 

November  2005  —  Microsoft  says  it  will  standardize  OOXML  through  ECMA. 

May  2006  —  ODF  approved  by  ISO  as  an  international  standard. 

December  2006  —  Ecma  376  (standardized  version  of  OOXML)  published,  ECMA 
submits  it  to  ISO. 

August  2007  —  Commonwealth  of  Massachusetts  adds  OOXML  to  list  of  approved 
open  standards;  battle  continues  to  rage  over  standardization  of  OOXML. 

April  2008  —  OOXML  becomes  an  official  ISO/International  Electrotechnical 
Commission  standard. 


BY  JOHN  FONTANA 

Microsoft’s  declaration  last  week  that  it 
would  finally  support  OpenDocument  Format 
and  join  in  further  development  of  the  rival 
format  was  applauded  by  many  critics  as  a 
major  step  forward,  but  the  outcome  of  those 
steps  will  be  under  review  for  years  to  come, 
observers  say 

After  winning  a  15-month,  acrimonious  battle 
to  get  Office  OpenXML  (OOXML)  approved  as 
a  standard  by  the  International  Standard¬ 
ization  Organization  (ISO),  Microsoft  last  week 
said  it  would  add  support  for  alternative  file  for¬ 
mats  in  Office  2007  by  the  middle  of  2009. 
Support  for  the  ISO  version  of  OOXML  proba¬ 
bly  will  come  in  the  same  time  frame  as  part  of 
the  next  full  release  of  Office. 

Foremost  among  those  alternative  formats  is 
ODF  which  was  as  the  rival  format  when 
OOXML  was  winding  its  way  first  through  the 
standardization  process  at  industry  standards 
association  ECMA,  then  at  the  ISO. 

The  European  Commission,  which  in  Jan¬ 
uary  opened  an  antitrust  investigation  into 
Microsoft  Office,  said  in  a  statement  that  it 
would  welcome  any  Microsoft  effort  toward 
more  interoperability,  consumer  choice  and 
less  vendor  lock-in. 

The  commission,  however,  weary  of  dealing 
with  Microsoft,  added  in  a  statement,  “The 
Commission  will  investigate  whether  the  an¬ 
nounced  support  of  OpenDocument  Format 
in  Office  leads  to  better  interoperability  and 
allows  consumers  to  process  and  exchange 
their  documents  with  the  software  product  of 
their  choice.” 

Critics  say  Microsoft  will  be  under  continued 
scrutiny,  given  that  it  does  not  plan  to  imple¬ 
ment  support  for  ODF  for  another  year.  The 
company  says  it  will  issue  a  Service  Pack  for 
Office  2007  that  will  add  support  for  ODF  PDF 
1.5, PDF/A  and  XML  Paper  Specification  (XPS), 
which  is  another  Microsoft-developed  format. 

“If  Microsoft  follows  through  on  this,  it  is  a 
very  positive  development,”  says  Marino 
Marcich,  executive  director  of  the  Open- 
Document  Format  Alliance.“But  we  have  seen 
that  states,  governments  and  others  are  looking 
for  actions  not  words.” 


IT  Buyer’s  Guides 

Compare  products  and  get  up-to- 
date  buying  tips,  market  trends,  best 
practices,  tech  primers  and  more  on 
dozens  of  networking  topics  at; 

www.networkworld.com/buyepsguides 


That  is  particularly  true,  given  that  Microsoft’s 
first  attempt  at  ODF  support  came  via  a  trans¬ 
lator  that  so  far  has  garnered  mixed  results  at 
best,  Marcich  says. 

“It  is  a  question  of  whether  Microsoft  is  throw¬ 
ing  ODF  into  the  back  of  the  bus  or  into  the 
front  of  the  bus  with  OOXML,”  Marcich  says. 
“What  do  they  mean  by  support?The  devil  is  in 
the  details,”  he  says. 

Microsoft  says  the  details  are  clear. 

“None  of  this  means  anything  unless  you 
deliver  interoperability  says  Tom  Robertson, 
general  manager  of  interoperability  and  stan¬ 
dards  at  Microsoft.  “This  is  not  just  shipping 
the  translator;  this  is  support  in  Office  2007  for 
ODF  1.1.” 

Office  2007  Service  Pack  2  will  let  users 
natively  open,  edit  and  save  documents  using 
ODF  and  save  documents  into  XPS  and  PDF 
formats  from  within  Office  applications,  he 
says.The  service  pack  also  will  let  ODF  be  set  as 
the  default  file  format  for  Office  2007. 

A  translator,  however,  will  be  used  to  support 
ODF  in  Office  2003,  XP  and  2000. 

Microsoft  will  participate  in  the  ISO  work¬ 
ing  group  maintaining  ISO  29500, the  OOXML 
standard,  and  will  join  the  ODF  working 
group  at  the  Organization  for  the  Advance¬ 
ment  of  Structured  Information  Standards 
(OASIS),  both  of  which  are  further  proof  of 


Microsoft’s  commitment,  Robertson  says. 

Some  say  Microsoft  should  have  joined  the 
OASIS  group  when  it  formed  in  2003,  and  now 
finds  itself  coming  full  circle  after  a  battle  at  the 
ISO  that  resulted  in  a  lot  of  bad  PR. 

Andy  Updegrove,  a  lawyer,  Linux  Foundation 
board  member  and  author  of  the  Con- 
sortiumlnfo.org’s  Standards  blog,  calls  the  ISO 
process  to  standardize  OOXML  a  “Pyrrhic  vic¬ 
tory  a  hollow  victory  gained  at  too  high  a  cost. 

“Microsoft  got  through  the  battle,  and  it’s  ‘we 
won,  now  what?’ Well, ‘now  what?’  turned  out  to 
be ‘so  what?’ What  did  they  gain?  It  appears  that 
for  a  couple  of  years  at  least,  they  have  not 
gained  anything.  And  a  five-year  strategy  [to 
dodge]  ODF  has  failed,”  Updegrove  says. 

Regardless,  Updegrove  says  he  is  encouraged 
by  Microsoft’s  willingness  to  support  ODF  and 
says  some  good  has  come  out  of  OOXML  stan¬ 
dardization  process. 

“It  has  demonstrated  that  the  traditional  ISO 
process  is  clearly  not  up  to  modern  challenges 
and  if  it  is  going  to  continue  to  be  relevant,  at  a 
minimum  it  needs  a  rules  overhaul  for  the 
tough  situations  [like  OOXML] .  And  second,  it 
has  made  the  public  aware  of  the  fact  that 
open  standards  are  as  important  as  open 
source, open  development, open  content, open 
research,  and  that  these  things  have  a  bigger 
meaning  than  just  vendor  to  vendor'' SB 
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know  it’s  coming;  we  just  don’t  know  in  what 
flavor,  how  soon,  and  how  people  will  make 
money  on  it.” 

Switching  the  media  from  rotating  disk 
drives  to  solid-state  drives  using  flash  mem¬ 
ory,  as  EMC  did  in  January  when  it  began 
offering  enterprise-class  flash  storage,  will 
have  significant  consequences,  Babineau 
says.  A  start-up  called  Pliant  Technology  has 
since  joined  EMC  in  building  solid-state 
flash  drives  for  enterprises. 

Flash  still  has  to  come  down  in  price  signifi¬ 
cantly  to  become  a  viable  alternative  to  disk  in 
most  companies,  EMC  officials  acknowledged. 
Disk  will  remain  the  less-expensive  option  in 
most  cases  for  the  foreseeable  future,  and  an 
important  part  of  a  customer’s  arsenal  for 
many  years,  they  said. 

Flash  storage,  however,  will  be  nearly  as 
affordable  as  high-end  disk  drives  by  the  end  of 
2010,  EMC  storage  president  David  Donatelli 
predicted.  Although  EMC  isn’t  the  company 
building  the  flash  chip  —  that  would  be  STEC 
—  EMC  will  use  its  influence  to  bring  the  price 
down,  he  said. 

EMC’s  bulk  buying  power  will  go  a  long  way 
toward  reducing  the  cost  to  customers,  Babin¬ 
eau  says.  “They’re  going  to  drive  the  cost  down 
and  make  it  an  alternative  to  disk,”  he  says.  “If 
you’re  a  big  consumer  with  a  product  and  you 
buy  in  bulk,  you  can  lower  the  cost.  EMC  did 
this  a  lot  with  the  enterprise  disk-drive  market.” 


BY  ELLEN  MESSMER 

Though  data-loss  prevention  gear  is  proving 
a  boon  for  corporate  security  its  “see  all,  know 
all”  style  of  content  monitoring  can  cast  a 
harsh  glare  on  business  practices  and  legal 
issues  that  put  IT  staff  on  the  spot. 

DLP  content-monitoring  equipment  often 
gets  rave  reviews  from  security  managers 
deploying  it  because  it  can  give  them  a  view 
they  never  had  before  into  their  organization’s 
daily  business  communications.lt  may  present 
the  big  picture,  zeroing  in  on  where  sensitive 
data  slipped  out  and  who  did  the  deed.  But 
chief  security  officers  with  months  of  DLP 
experience  caution  that  all  this  newfound 
knowledge  can  be  disruptive,  spotlighting 
internal  data-management  practices  that  incite 
concern  about  possible  regulatory  violations. 

“You  move  from  ignorance  to  compliance 
jeopard^’  acknowledged  Tony  Spinelli,  senior 
vice  president  of  information  security  at  credit 
information  services  firm  Equifax,  describing 
one  impact  that  deploying  DLP  —  in  this  case, 


In  cloud  storage,  EMC  bought 
online  backup  provider  Mozy  last 
September,  and  for  the  last  few 
months  has  been  shipping  beta 
versions  of  its  Hulk  hardware,  a 
bulk,  high-density  storage  product. 

Hulk  will  be  paired  with  the  Maui 
file-system  software.  EMC  has  been 
vague  about  these  products,  but 
Tucci  said  more  details  will  be 
forthcoming  soon. 

“You’ll  see  it  launched  with  a 
formal  name  and  fanfare  shortly” 

Tucci said. 

EMC’s  hardware  and  software 
might  help  the  emerging  cloud- 
storage  market,  in  which  such  ven¬ 
dors  as  Amazon.com  and  Nirvanix 
are  offering  highly  distributed  and 
scalable  storage  systems  that  are 
accessed  via  the  Web. 

Hulk  and  Maui  put  EMC  in  a  good  position  to 
tackle  this  growing  segment,  says  analyst  Rob 
Enderle.He  thinks  Tucci  is  underestimating  the 
speed  with  which  cloud  storage  will  transform 
how  customers  store  and  access  information, 
however.“I  heard  Tucci  say  that  he  didn’t  think 
the  data  center  would  move  to  the  cloud  in  his 
lifetime,”  he  says,  noting  that  he  disagrees.  “By 
the  end  of  10  years,  we  are  going  to  be  saying 
the  data  center  is  in  the  cloud.  These  things 
tend  to  happen  a  lot  faster  than  we  anticipate.” 

One  obvious  roadblock  is  the  security  of 
moving  data  from  corporate  data  centers  to 
Web-based  systems.  Data  becomes  less  secure 


the  Symantec  Vontu  equipment  —  made  at  his 
firm. ‘A  lot  of  regulations  say  when  you  know 
what’s  leaving  your  network,  you  have  to  dis¬ 
close  that.” 

Spinelli,  who  spoke  on  a  panel  at  last  month’s 
RSA  Conference  on  the  topic,  said  in  spite  of 
the  initial  disruption  caused  by  finding  out 
about  internal  business  data  practices  that  had 
to  be  fixed,  Equifax  is  now  so  accustomed  to 
DLP  content-monitoring  that  it’s  considered 
just  part  of  the  security  “hygiene.” 

DLP  also  has  played  a  role  in  bringing 
together  the  human  resources,  legal  and 
security  groups  at  Equifax  to  coordinate 
content-monitoring  policy  he  added. 

Two  other  security  managers  who  joined 
Spinelli  at  the  RSA  panel  to  discuss  DLP  also 
cited  its  disruptive  influence. 

“How  do  you  look  at  your  data,  know  your 
data  and  understand  what  you  have?  We  never 
had  tools  to  tell  us  what  was  happening  and 
we  relied  on  anecdotal  evidence  or  audits  to 

See  DLP,  page  38 


The  EMC  Disk  Library  3D 
3000,  a  new  LAN  backup-to- 
disk  system  that  targets 
midsize  businesses,  uses 
policy-based  data  dedupli¬ 
cation  and  IP  replication  to 
ensure  availability. 

“by  definition”  when  it  leaves  a 
customer’s  own  data  center, says 
security  analyst  and  Network 
World  Lab  Alliance  member 
Joel  Snyder.  Tucci  predicted 
cloud  data  will  be  easier  to  pro¬ 
tect,  despite  being  more  easily 
shared  and  accessible  from  any 
device.  RSA  security  capabilities 
embedded  into  the  EMC  cloud 
infrastructure  will  help  make 
this  happen,  the  company  says. 

Flash  and  cloud  storage  will  help  EMC  make 
plays  in  the  small  business  and  consumer  mar¬ 
kets.  Flash  is  unique  in  that  it  is  gaining  a 
foothold  in  the  low  end  of  the  storage  market, 
with  pocket  flash  drives,  as  well  as  with  high- 
end  corporate  customers,  Enderle  says.  Cloud 
storage  is  making  it  easier  for  individuals  to 
store  and  back  up  data. 

Six  years  ago  EMC  made  all  its  profits  in  the 
high-end  storage  marketplace,  but  is  making 
a  concerted  effort  to  attract  individual  con¬ 
sumers  as  well  as  small  and  midsize  busi¬ 
nesses, Tucci  said. 

“They  clearly  now  are  gaining  the  look  and 
feel  of  an  emerging  consumer  company  and 
that  could  go  in  a  number  of  really  interesting 
directions,”  Enderle  says. 

Although  EMC  hypes  the  potential  of  flash 
and  cloud  storage,  the  vendor  used  EMC  World 
to  release  products  aimed  at  helping  cus¬ 
tomers  better  manage  the  rapidly  growing 
amounts  of  data.  One  of  the  keys  is  spreading 
EMC’s  de-duplication  technology  across  more 
products  in  its  portfolio. 

Duplicate  data  is  a  huge  problem  for  busi¬ 
nesses  struggling  with  an  average  60%  annual 
data  growth.“Then  you  add  in  the  fact  that  data 
center  real  estate  is  expensive  [and]  power  is 
nowhere  to  be  found  in  a  lot  of  cities,  a  lot  of 
areas,”  Babineau  says.  “The  only  way  you  can 
meet  your  challenges  is  to  not  store  your  data 
over  and  over  again.” 

Last  week’s  releases  bring  deduplication  to 
the  new  EMC  Disk  Library  products  and  the 
pre-existing  Avamar  backup  and  recovery  pro- 
ducts.The  variety  is  important  because  Avamar 
gives  customers  the  ability  to  deduplicate  at 
the  source  side  (before  data  is  backed  up)  and 
Disk  Library  provides  deduplication  at  the  tar¬ 
get  side  (the  final  device  the  data  is  stored  on), 
Babineau  says. 

EMC  World  also  serves  as  a  classroom  of 
sorts,  with  556  sessions  filled  with  keynote 
addresses  and  technical  overviews  of  EMC 
technologies  and  products. 

Babineau  says  he  was  surprised  EMC  drew 
more  than  9,000  people  to  the  event  during 
tough  economic  times.  ■ 


Why  data-loss  prevention 
tools  scare  some 
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DNS  CHANGE  MAKERS 


Mastering  DNS  has  always  been  challenging  -  some  would  say  it’s  as  much  art  as  science. 
And  while  I’m  thrilled  that  DNS  plays  a  key  role  in  essentially  all  network  applications, 
I’m  concerned  by  current  trends.  We’re  now  seeing  more  frequent  attacks  against  DNS 
infrastructure.  Recently,  for  example,  we  saw  a  spate  of  what  are  referred  to  as 
“DNS  amplification”  attacks  in  which  open  recursive  name  servers  are  used  as  amplifiers  to 
swamp  targets  on  the  Internet.  Turns  out  that  name  servers  are  terrific  amplifiers  — 

you  can  get  an  amplification  factor  of  nearly  lOOx.  These  attacks 
have  raised  awareness  of  the  vulnerability  of  Internet 
name  servers,  which  is  possibly  the  only  positive  result. 

Dealing  with  DNS  issues  is  becoming  a  full  time  job  for 
organizations.  My  company,  Infoblox,  provides  leading 
edge  products  to  help  IT  managers  better  handle 
their  DNS  network  management  challenges. 


When  I  need  an  answer  fast,  I  go  to  a  source  I  trust  — 
DNSstuff.com.  Comprehensive  troubleshooting  and 
problem  solving  tools  in  one  place.  That's  powerful. 

Think  all  DNS  tools  are  the  same? 

Think  again. 


Cricket  Liu,  DNS  guru,  author  6t  VP  of  Architecture,  Infoblox 


■1  DNSstuff.com 
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continued  from  page  1 

IT  managers  agree  IBM’s  message,  dubbed 
the  industrialization  of  IT,  is  on  target  as  they 
look  to  automate  such  processes  as  service 
request,  asset  management  and  disaster  recov¬ 
ery  tasks. 

“We’d  have  to  hire  15  people  to  do  the  bare 
minimum  of  what  we  are  using  IBM  software  to 
do  nowf  says  Matthew  Elston,  a  technical  man¬ 
ager  at  pharmacy  benefits  manager  Health- 
Trans  in  Greenwood  Village,  Colo. “With  virtual¬ 
ization,  transaction-based  applications  and  the 
need  to  scale  business  fast,  you  just  can’t  have 
five  people  working  in  IT, supporting  it  all  man¬ 
ually.  People  need  to  sleep.” 

Elston  is  part  of  a  team  at  HealthTrans  work¬ 
ing  with  IBM  Tivoli’s  Workload  Scheduler  and 
Dynamic  Workload  Broker  applications  to 
move  hundreds  of  homegrown  scripts  into 
process  templates  so  the  company  can  add 
clients  more  quickly  without  having  to  add 
head  count. 

“Our  applications  need  to  process  in  sub¬ 
seconds,  and  we  need  to  keep  transaction 
response  time  at  a  minimum  without  having 
to  grow  IT  staff  as  the  business  grows,”  says 
Brian  Frantz,  operations  manager  at  Health¬ 
Trans.  “Before  these  products,  our  processes 
couldn’t  scale,  the  scripts  were  10  years  old. 
Now  it’s  a  case  of  being  able  to  constantly 
evolve  our  environment  without  overhaul¬ 
ing  everything.” 

The  case  for  automation  at  HealthTrans  is 
not  unique.The  push  to  incorporate  automa¬ 
tion  technology  is  becoming  more  common 
across  all  types  of  businesses  as  the  need 
grows  for  IT  to  expand  operations  and  pro¬ 
vide  more  services  with  the  same  resources. 
The  technology  has  shifted  from  a  nice-to- 
have  to  a  must-have  in  the  past  18  months, 
industry  watchers  say,  and  its  relevance  to 
data-center  operations  will  only  continue  to 
grow  in  importance. 

“The  number  of  things  to  be  managed  is 
going  to  explode.  IT  organizations  cannot  hire 
human  labor  to  keep  up  with  the  proliferation 
of  devices,  tags,  applications  and  more  that  will 
become  standard  in  data  centers,”  says 
Jasmine  Noel,  principal  analyst  at  Ptak,Noel  & 
Associates.  “It’s  not  about  comfort  levels  with 
automation  or  streamlining  certain  processes. 
To  effectively  run  IT  operations,  there  is  no 
longer  a  choice  with  automation.” 

Autonomic  history 

IBM  kicked  off  its  autonomic  computing  ini¬ 
tiative  in  2001,  and  until  recently  represented 
the  primary  proponent  for  automation  tech¬ 
nology  among  management  competitors 
BMC  Software,  CA  and  HP  In  the  past  18 
months,  HP  acquired  data-center  automation 
vendor  Opsware,  and  BMC  picked  up  run- 
book  automation  start-up  RealOps  along  with 
BladeLogic. 

This  year  CA  partnered  with  automation 
player  Opalis  Software  in  a  deal  rumored  to 


**We’d  have  to  hire  15  peo¬ 
ple  to  do  the  bare  minimum 
of  what  we  are  using  IBM 
software  to  do  now.55 

Matthew  Elston 

Technical  manager,  HealthTrans 

portend  an  automation  acquisition  by  CA 
later  this  year. 

With  competitors  making  big  news,  industry 
watchers  say  IBM’s  automation  capabilities 
could  appear  stale  to  customers  despite  the 
fact  that  Big  Blue  has  been  quietly  developing 
a  formidable  automation  portfolio  within  its 
management  software  tools. 

“When  I  look  at  IT  process  automation  as 
one  of  the  important  parts  of  effective  service 
delivery  I  look  to  how  well  a  vendor  integrates 
its  own  products.  About  a  year  or  so  ago,  IBM 
had  a  big  problem  in  this  area,”  says  Andi 
Mann,  research  director  at  Enterprise  Manage¬ 
ment  Associates.  “IBM  has  done  a  lot  of  work 
around  integrating  their  products  in  useful  and 
practical  ways  to  enable  similar  interfaces  and 
workflows  across  the  products.” 

For  instance,  IBM  integrated  the  Maximo  user 
interface  technology  it  acquired  with  MRO 
Software  with  its  Tivoli  Process  Automation 
Platform  to  provide  a  more  intuitive  console 
from  which  data-center  IT  or  facilities  staff 
could  quickly  and  easily  access  information 
about  technology  or  physical  components.The 
software  also  enables  staff  to  build  and  store 
workflows  to  be  used  repeatedly 

For  Will  Showalter,  COO  at  Sisters  of  Mercy 
Hospital  in  St.  Louis,  Mo.,  IBM’s  MRO  Soft¬ 
ware  acquisition  drove  a  technology  pur¬ 
chase  around  IT  service  catalogs  and  an 
engagement  with  IBM  Global  Technology 
Services.  Showalter  is  standardizing  service- 
management  operations  across  locations  in 
seven  states,  and  needed  the  service  desk 
technology  and  IBM  process  expertise  its 
service  group  offered. 

“IBM  has  a  deep  understanding  of  its  own 
tools  and  knows  the  best  practices  necessary 
to  integrate  the  technology,  ITIL  and  opera¬ 
tions,”  Showalter  says.  “Automating  more  pro¬ 
cesses  has  freed  us  up  to  concentrate  on 
capacity  management  and  building  out  our 
environment  instead  of  fielding  calls.” 

Still,  industry  watchers  say  IBM  needs  to  do 
more  work  on  building  connectors  to  other 
vendors’ software  and  helping  customers  more 
easily  develop  processes  its  technology  can 
automate. Customers  shouldn’t  need  to  engage 
in  a  services  contract  to  get  IBM’s  extensive 
process  expertise  loaded  into  the  vendor’s  soft¬ 
ware  products. 

“IBM  needs  to  broaden  what  IBM  software 
will  work  with  to  automate  processes  across 
the  entire  data  center’’ Mann  says.“Better  inte¬ 
gration  and  out-of-the-box  processes  are  where 
IBM  is  behind  competitors  like  BMC  and  CA.” 


Green  motivations 

Also  as  part  of  its  effort  to  help  customers 
improve  data  center  operations,  Big  Blue  bun¬ 
dled  power  use  and  consumption-monitoring 
technologies  into  its  IBM  Tivoli  Monitoring  pro¬ 
ducts  to  help  the  8,000  customers  of  those 
applications  start  tracking  green  metrics  along¬ 
side  traditional  IT  data. 

“Going  green  is  a  cloudy  issue  for  many  IT 
managers  in  terms  of  what  it  really  means.This 
feature  is  simple  to  deploy  and  will  show  re¬ 
sults  in  such  a  way  that  it  will  be  easier  for  IT  to 
communicate  the  value  of  changing  infra¬ 
structure  management  to  support  more  en¬ 
ergy-efficient  products  and  processes,”  says 
Rich  Ptak,  co-founder  and  analyst  at  Ptak,  Noel 
&  Associates. “The  data  the  green  monitor  col¬ 
lects  also  can  help  with  capacity  management 
and  potentially  predict  power-related  failures.” 

IBM  partnered  with  such  companies  as 
Eaton  Corp.,  Emerson  Network  Power  and 
Johnson  Controls  to  enable  its  software  to 
receive  data  from  third  parties.  The  partner¬ 
ships  resonate  with  customers  that  are  looking 
to  cut  costs  but  aren’t  prepared  yet  to  tackle  the 
environmental  benefits  green-computing  ad¬ 
vocates  propose. 

“Businesses  are  facing  a  real  crisis  for  avail¬ 
able  power  in  data  centers.  Economics  will  be 
the  driving  force  in  what  people  will  do  envi¬ 
ronmental^’  Mills  says. 

Rodney  Caston,  manager  of  corporate  engi¬ 
neering  at  MetroPCS,  a  wireless-communica¬ 
tions  service  provider  in  Dallas,  says  his  com¬ 
pany  has  yet  to  assess  fully  how  it  will  start 
implementing  green  technology  but  concedes 
the  promise  of  cost  savings  will  be  a  driver  for 
adopting  energy-efficient  monitoring  tools. 

“Given  the  cost  of  energy  is  on  the  rise,  and 
the  fact  that  IBM  is  showing  leadership  in  this 
area,  I’ll  be  looking  at  better  ways  we  can  han¬ 
dle  our  energy  and  power  consumption,” 
Caston  says.  ■ 


ONLINE:  Q&A  with  Mills 

Steve  Mills,  senior  vice  president  and 
group  executive  of  IBM  Software 
Group,  sat  down  with  Network  World 
Senior  Editor  Denise  Dubie  to  discuss 
Big  Blue's  software  strategy,  which 
includes  increasing  data-center  man¬ 
agement  and  automation  technologies. 
Mills  also  shared  his  take  on  hot  net¬ 
work  topics  including: 

•  The  complexity  of  managing  IT. 

•  The  value  of  embedding  intelli¬ 
gence  in  the  network. 

•  The  ways  IBM  technologies 
complement  Cisco’s  VFrame 
technology. 

www.nwdocfinder.com/5048 
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Should  your  IT  staff  telework? 

Remote  access  technologies  let  IT  work  remotely 


BY  ANN  BEDNARZ 

Being  available  to  troubleshoot  tech  problems  remotely,  at  all  hours  of 
the  night  and  on  weekends,  goes  with  the  territory  for  IT  pros.  But 
working  from  home  during  business  hours?  Not  so  much. There  are 
signs,  however,  that  attitudes  could  be  changing. 


CIOs  polled  late  last  year  by  Robert  Half 
Technology  indicate  telecommuting  by  IT  staff 
members  is  gaining  ground  in  some  compa¬ 
nies.  Asked  if  their  IT  workforce  is  telecom¬ 
muting  at  a  higher  rate  than  five  years  ago,21% 
said  they  have  more  telecommuters  now,  23% 
said  it’s  the  same  proportion,  and  only  3%  said 
fewer  IT  employees  are  telecommuting.  Just 
more  than  half  (51%)  of  the  1,400  respondents 
said  they  don’t  offer  telecommuting  to  IT  staff. 

The  impetus  for  IT  workers  to  work  from 
home  is  likely  no  different  from  what’s  driving 
any  other  profession  to  consider  telework:  Sky- 
high  gas  prices,  traffic  congestion,  a  desire  to 
be  environmentally  friendly,  business  continu¬ 
ity,  commercial  real  estate  savings,  and  the 
appeal  of  flexible  work  arrangements,  to  name 
a  few  of  the  drivers. 

“There  are  plenty  of  good  reasons  to  tele¬ 
work,  but  right  now  I  think  that  the  big  mover 
is  gasoline  prices,”  says  Chuck  Wilsker,  presi¬ 
dent  and  CEO  of  the  Telework  Coalition,  an  or¬ 
ganization  in  Washington,  D.C.,  that  promotes 
telework  through  education  and  legislative 
efforts. 

In  addition,  remote-access  technologies 
have  matured  a  lot  over  the  last  several  years, 
making  it  possible  to  troubleshoot  IT  prob¬ 
lems  in  the  middle  of  the  night  without  scram¬ 
bling  to  the  data  center. 

“As  recently  as  five  years  ago,  your  beeper 
would  go  off,  you’d  have  to  wake  up,  leave 
home,  hike  it  to  the  office  and  do  some¬ 
thing.  That  doesn’t  really  happen  anymore,” 
says  Jasmine  Noel,  a  partner  at  Ptak,  Noel  & 
Associates.  With  today’s  browser-based  sys¬ 
tems  management  tools, “you  can  get  most, 
if  not  all,  of  same  functionality  that  you 
would  get  if  you  were  physically  in  the 
office,”  Noel  says. 

Logging  on  from  home 

IT  workers  can  use  technologies  like  Remote 
Desktop  Protocol,  Secure  Shell  and  terminal 
servers  to  interact  with  servers  and  desktops. 
Out-of-band  equipment  and  secure  remote- 
access  appliances  let  them  access  hardware- 
level  controls  when  the  network  is  down,  says 
Andi  Mann,  research  director  at  Enterprise 
Management  Associates. 

Those  same  tools  could  facilitate  working 


Good  for  business 

Improved  retention  and  morale,  along 
with  greater  productivity,  are  the  top 
benefits  companies  get  when  IT 
workers  telecommute,  according  to 
a  Robert  HalfTechnology  survey  of 
1,400  CIOs. 

Which  telecommuting  attribute  is 
most  beneficial  to  the  business? 


Other  4°/cr 

Can  hire  employees 
in  lower  cost-of- 
living  areas  for 
lower  salaries  6% 


Improves  retention 
and  morale  through 
enhanced  work/life 
balance  34% 


Saves  money  by 
requiring  less 
office  space 

12% 


Don’t 

know 

16% - 


28% 


Increases  productivity 
by  reducing  commute 
time 


from  home  full-time,  if  companies  are  open  to 
the  idea. 

“Certainly  some  companies  will  push  back 
on  this  remote  access,  because  they  don’t 
have  the  technology  or  procedures  in  place, 
because  managers  are  unable  to  adapt,  or 
maybe  their  staffs  are  not  right  for  telecom¬ 
muting,”  Mann  says.  “But  I  am  seeing  progres¬ 
sive  IT  organizations  —  including  some  of  the 
largest  finance  corporations  in  the  world  — 
already  managing  their  server  environments 
remotely  Their  system  administrators  are  set 
up  with  multiple  consoles,  VPN  and  remote 
access  protocols  in  a  home  office  on  the  other 
side  of  the  country’ 

One  strategic  driver  is  the  ability  to  recruit  IT 


talent  from  all  parts  of  the  world. “This  is  a  very 
real  opportunity  for  enterprises  to  attract  the 
very  best  talent,  provide  high  value  adminis¬ 
tration  and  reduce  costs,”  Mann  says. 

Eric  Bruner  works  full-time  for  Sallie  Mae 
from  his  home.  But  he  didn’t  always  telecom¬ 
mute.  Bruner  first  worked  in  one  of  Sallie  Mae’s 
corporate  offices  for  eight  years  before  mak¬ 
ing  the  switch  to  teleworking. 

Having  some  initial  in-person  experience 
with  co-workers  is  helpful, particularly  in  the  IT 
field,  says  Bruner,  who  is  director  of  marketing 
operations  (and  former  senior  manager  of  sys¬ 
tems  development)  at  the  Reston,Va.-based 
financial  services  provider. 

“When  you  first  start  working  in  IT,  and  with 
people  who  are  doing  what  you’re  doing,  it 
would  be  much  more  difficult  to  learn  from 
others  if  you  were  telecommuting,  because 
they’re  not  right  next  to  you,”  he  says.The  new 
people  learn  from  the  more  veteran  people, 
and  if  they  aren’t  all  sitting  together,  you  can 
lose  out  on  a  lot  of  training  that  occurs  infor¬ 
mally  in  IT’ 

Ironically  staying  in  touch  can  be  easier  as  a 
teleworker,  he  has  found.  As  an  in-office  man¬ 
ager,  Bruner  spent  a  lot  of  time  in  meetings, 
and  his  direct  reports  tended  to  touch  base 
only  when  they  could  catch  him  in  his  office. 
As  a  teleworker,  Bruner  says  his  reports  are 
able  to  contact  him  more  quickly  with  instant 
messaging,  email  or  the  phone. 

“When  I  started  telecommuting  I  had  10 
direct  reports.  After  I  had  worked  remotely  for 
a  few  months,  I  asked  how  things  were  differ¬ 
ent  for  them.  They  said  I  was  more  accessible 
to  them  than  I  had  been  when  I  was  in  the 
office,”  Bruner  recalls.. 

One  tech  executive  who  has  done  an  about- 
face  on  the  issue  of  IT  workers  telecommuting 
is  John  Halamka.  “I  believed  that  employees 
needed  proximity  to  work  together  effectively 
1  no  longer  believe  that  to  be  true,”  says 
Halamka,  who  is  CIO  of  Boston’s  CareGroup 
Health  System  and  CIO  and  technology  dean 
at  Harvard  Medical  School. 

Halamka  wrote  an  article  for  CIO  magazine 
in  which  he  detailed  what  changed  his  mind 
and  led  him  to  pursue  a  telework  pilot,  which 
is  ongoing,  for  certain  call  center  employees, 
medical  record  coders  and  desktop  engineer¬ 
ing  teams  at  CareGroup’s  Beth  Israel 
Deaconess  Medical  Center. 

Not  for  everyone 

As  in  every  industry,  however,  there  are 
roadblocks  slowing  telework  adoption  by  IT 
professionals. 

See  Telework,  page  24 
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Cambers:  Cisco's  future  is  Web  2.0 

Acknowledges  Cisco’s  “miserable”  experience  with  collaboration  in  the  past 


BY  JON  BRODKIN 

Cisco’s  future  depends  on 
technologies  that  enable 
human  collaboration,  CEO 
John  Chambers  says. 

“We  build  our  culture  at  Cisco 
around  catching  market  transi¬ 
tions”  Chambers  said  last  week 
during  a  keynote  address  about 
Web  2.0  and  collaboration  at 
Forrester  Research’s  IT  Forum 
in  Las  Vegas.  Cisco’s  moves  in  Web  2.0,  from  its 
TelePresence  video  conferencing  technology 
to  the  acquisition  of  WebEx,  are  steps  toward 
making  sure  Cisco  doesn’t  get  upstaged  by 
more  innovative  competitors. 

“It  isn’t  just  about  growth,  it’s  about  survival,” 
Chambers  said. “Market  transitions  are  built  on 
catching  them  right,  and  if  you  miss  them  it’s 
almost  impossible  to  recover’’ 

Chambers  also  talked  about  how  collabora¬ 
tion  efforts  within  Cisco  almost  failed. An  effec¬ 
tive  Web  2.0  strategy  has  to  be  spearheaded  by 
a  CEO,  but  leadership  also  has  to  give  up  some 
power  to  make  it  work,  he  noted. 

“The  hard  part  about  collaboration  is  we 
don’t  like  change,”  Chambers  said.  “Nor  did 
my  organization  and  nor  did  1. 1  love  com¬ 
mand  and  control  and  I’m  pretty  good  at  it. 
Sixty-five  thousand  people,  I  say  turn  right, 
we  turn  right.  1  very  rarely  have  to  say  it 
twice.  That’s  not  the  future.  It’s  the  ability  of 
groups  to  think  together,  to  combine  knowl¬ 
edge  and  experience.” 

The  first  two  years  of  collaboration  in  Cisco 
were  “miserable,”  Chambers  said,  noting  that 
when  he  first  thought  about  Web  2.0  he  was  in¬ 
terested  mainly  in  telepresence  and  simple 
forms  of  collaboration. 

Thirty-year-old  employees  told  him,  “you’ve 
got  to  quit  talking  about  just  telepresence  with 
collaboration.  You’ve  got  to  really  say  how  all 
these  tools  —  the  blogging  capabilities,  the 
wikis,  etc.  —  really  tie  together  into  an  archi¬ 
tectural  approach,”  Chambers  said. 

It  got  better.  “Now  it’s  almost  viral  at  Cisco,” 
Chambers  said.  “It  took  me  making  some 
changes.  About  20%  of  my  leadership  did  not 
make  it  through  this.” 

Chambers  started  roaming  through  the  audi¬ 
ence  of  several  hundred  people  as  he  talked 
about  collaboration.  He  discussed  Cisco’s  uni¬ 
fied  communications  strategy  —  of  letting 
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users  collaborate  with  any  device  —  and  how 
telepresence  will  be  integrated  seamlessly  with 
other  technologies  such  as  blogging  and  wikis. 
He  previewed  some  technology  that’s  right  out 
of  “Star  Trek.” “Within  a  very  short  time  we  will 
be  able  to  do  holograms  with  this  type  of  tech¬ 
nology  so  you  can  literally  beam  people  into  a 
room  and  have  a  conversation  virtually” 
Chambers  said.“We  already  demonstrated  that 
in  India.” 

Chambers’  preferred  methods  of  communi¬ 
cating,  he  said,  are  text  messages  and  video. 
Beyond  collaborating  internally,  he’s  doing 
more  virtual  meetings. 

He  travels  physically  to  many  countries 
throughout  the  year,  but  with  telepresence  he 
will  double  the  number  of  customers  he 
speaks  with  while  doing  half  his  customary 
travel,  he  added. 

Voice  and  video  are  the  keys  to  collaboration 
among  people  who  aren’t  physically  near  each 
other,  Chambers  said.  He  used  to  think  telep¬ 
resence  was  90%  as  effective  as  an  in-person 
meeting;  now  he  thinks  it’s  even  better  than  an 


in-person  meeting  because 
of  tools  that  let  him  easily 
share  data  with  people  on 
the  other  end  of  the  conver¬ 
sation,  he  said. 

“For  me,  it’s  a  lot  like 
‘Scotty,  beam  me  up,’” 
Chambers  said.  “What  is 
missing  is  integrating  it  with 
a  lot  more  tools, which  we’re 
going  to  attempt  to  do. You’ll 
see  that  it  will  capture  the  imagination  of 
what’s  possible.” 

In  Chambers’  view  of  the  future,  people  col¬ 
laborate  from  anywhere,  using  any  device  in 
any  mode  they  want.  Virtually  nothing  will  be 
confined  to  one  physical  location,  and  net¬ 
works  will  no  longer  be  “device-sensitive.” 

“We’ll  talk  about  everything  in  the  future,  in 
my  opinion,  as  a  service,”  Chambers  said.“Not 
just  software-as-a-service,  but  . . .  processing 
power  as  a  service,  storage  as  a  service,  band¬ 
width  as  a  service.” 

While  it’s  opened  the  doors  to  more  effective 
collaboration,  Web  2.0  has  brought  with  it  a 
number  of  security  headaches.  Point  products 
solving  specific  problems  won’t  be  enough, 
Chambers  said.  A  holistic  approach  that  views 
security  as  an  architecture  rather  than  a  set  of 
individual  technologies  is  needed. 

“There  is  no  such  thing  as  a  secure  data 
center  or  secure  network,”  Chambers  said. 
“There’s  just  degrees  of  security  where 
you’re  going  to  be  one  or  two  steps  ahead  of 
the  bad  guys.”H 


Telework 

continued  from  page  23 

The  IT  industry  is  susceptible  to  the  same 
doubts  (which  telework  advocates  work  hard 
to  dispel)  about  whether  teleworkers  are 
working  hard  enough.  In  the  Robert  Half  sur¬ 
vey,  44%  of  CIOs  felt  that  quality  of  work  suffers 
due  to  diminished  in-person  contact  with  col¬ 
leagues,  and  30%  felt  that  telecommuting  em¬ 
ployees  are  not  as  productive  because  they 
have  less  oversight. 

In  addition,  31%  of  CIOs  felt  that  telecom¬ 
muting  employees  generate  too  many  security 
risks  because  they  need  to  access  corporate 
networks,  systems  and  intellectual  property 
off-site. 

Another  concern  for  some  IT  teams  is  that 
allowing  teleworking  could  lead  a  company 
to  decide  to  outsource  its  IT  operations,  indus¬ 
try  analyst  Noel  says.“There’s  fear  that  if  peo¬ 
ple  get  used  to  IT  not  having  to  come  in  to  the 
office,  then  it’s  only  a  short  step  to  say,  ‘Well 
then  why  can’t  we  just  outsource  IT  com¬ 


pletely?”’ she  says. 

Plus  for  some  IT  jobs,  being  onsite  is  key  to 
getting  the  job  done. 

Certain  IT  roles  such  as  programming,  appli¬ 
cation  development  and  consulting  might 
lend  themselves  to  telework,  notes  Craig  Bush, 
a  network  administrator  at  Exactech  in 
Gainesville,  Fla.  But  if  a  job  requires  hands-on 
work, such  as  installing  network  equipment,  or 
face-to-face  interaction  with  users,  such  as 
help  desk,  he  doesn’t  think  it  should  be  a  can¬ 
didate  for  working  from  home. 

“We  don’t  currently  encourage  work  at 
home  as  we  generally  cannot  solve  the 
problems  and  troubleshoot  things,  nor  can 
we  provide  customer  service  to  our  internal 
customers  by  working  outside  the  office," 
Bush  says. 

Maintaining  a  healthy  work-life  balance 
comes  from  having  a  clear  separation 
between  work  and  home  life,  he  adds.  “I  also 
think  it’s  probably  a  good  thing  [we  don’t  tele¬ 
work]  ,  as  we  get  a  proper  work-life  balance  by 
the  separation  of  our  work  and  home  life.”  ■ 


24  •  MAY  26,  2008  •  www.networkworld.com 


We’re  talking  99.999%  reliability. 
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Bleak  prospects  for  privacy 


While  Web  surfing  the  other  day  I  ran 
across  a  London  Times  story  that 
described  two  shopping  malls  in 
England  that  individually  track  everyone  who 
walks  into  their  environs  (as  long  as  they  have 
a  cell  phone  turned  on). 

This  seems  to  me  to  be  about  the  ideal  exam¬ 
ple  of  modern  society  — 
a  society  in  which  some¬ 
one  who  thinks  that  some 
privacy  might  be  nice  is 
starting  to  be  seen  as 
quaint  and  more  than  a  bit  out  of  touch. 

Many  people  wag  their  fingers  at  China’s 
pervasive  surveillance  of  its  citizens,  but  that 
is  hardly  the  only  example  of  governments 
watching  their  people.  Governments  the  world 
over  are  moving  toward  a  future  not  only  in 
which  Mr.  Charrington  in  his  junk  shop  will  be  the  norm  —  but 
also  one  where  Mr.  Charrington  will  not  have  to  guess  what  you 
have  been  up  to. 

Even  where  there  is  supposed  to  be  a  basic  rule  that  government 
has  to  have  a  real  reason  before  it  can  find  out  your  every  move  (for 
example,  the  Fourth  Amendment  in  the  United  States),  people  who 
work  for  the  government  want  badly  to  ignore  it. Then  there  is  the 
desire  of  some  ostensibly  well-meaning  folk  to  figure  out  how  to  con¬ 
trol  the  entire  electronic  world  without  realizing  that  if  they  can  do  so 
it  will  only  be  proof  to  the  bad  guys  that  it  can  be  done.  It  would  not 
be  long  before  the  bad  guys  found  the  same  security  holes  and  the 
government  computers  would  befall  the  same  fate. 


It’s  not  only  governments.  As  I’ve  written  before,  Google  —  or  your 
own  favorite  search  engine  company  —  already  knows  far  more 
about  you  than  even  you  do.  Just  last  week  there  were  stories  about 
ISPs  starting  to  use  Web  surfing  monitors  to  better  provide  ads  they 
might  be  interested  in  delivering  to  their  customers  —  ads  that  are 
more  likely  to  get  customers  to  buy  something  they  likely  did  not 
need  (see  “U.S.  Reps.  Markey,  Barton  Question  Charter  About  Web 
Tracking”  (www.nwdocfinder.com/5027). 

The  two  companies  producing  the  technology 
to  do  this  that  are  showing  up  in  news  articles 
are  NeubAd  and  Phorm.l  wrote  about  NeubAd 
a  while  back  (www.nwdocfinder.com/5029). 
Both  of  these  companies  claim  to  not  save  any¬ 
thing  that  can  identify  specific  users,  but  minor 
tweaks  to  their  software  would  fit  right  into  the 
future  that  National  Security  Agency  Director 
Michael  McConnell  would  like  to  see.They  both 
also  appear  to  use  cookie-based  opt-out  mecha¬ 
nisms  that  do  not  work  at  all  for  people  who  are  in  a  habit  of  regularly 
removing  cookies. 

Maybe  we  do  not,  or  will  not,  have  any  privacy  But  that  does  not 
mean  that  the  world  will  actually  be  safer  —  it  will  just  be  a  lot  colder 
(in  spite  of  global  warming). 

For  those  who  do  not  recall  Mr.  Charrington,  try  Google  (and  add  a 
little  to  the  search  engine  company’s  recording  of  your  life). 

Disclaimer:  The  above  rant  did  not  make  me  feel  any  better  nor  did 
Harvard  join  in  (or  even  know  about  it). 

Bradner  is  Harvard  University's  technology  security  officer.  He  can  be 
reached  at  sob@sobco.com. 


NET  INSIDER 

Scott  Bradner 


Google  —  or  your  own 
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Be  an  ISP:  internal  services  provider 


A  big  buzzword 
these  days  for  net¬ 
work  and  com¬ 
munications  teams  is 
“internal  services 
provideCThe  idea  is 
for  the  communica¬ 
tions  group  to  position 
itself  as  a  provider  of  a 
range  of  services  to  the 
organization’s  users,  typ¬ 
ically  with  a  chargeback 
mechanism  in  place. 
Why?  One  reason  is  to 
lay  to  rest  the  notion  that  outsourcers  can 
provide  higher-quality  services  at  a  lower 
cost.Typicallythey  can’t  —  they  can  do  one 
or  the  other,  but  not  both.  (As  the  old  consult¬ 
ing  adage  goes:  You  can  have  faster,  better  or 
cheaper  —  pick  two.)  If  you  want  out¬ 
sourcers  to  provide  services  that  are  both  bet¬ 
ter  and  less  expensive  —  well,  good  luck 
with  that. 

However,  a  communications  team  can’t 
make  that  argument  if  neither  the  quality  nor 
the  cost  of  the  services  they  provide  is  mea¬ 
sured  and  quantified.  So  one  reason  to 
restructure  the  communications  team  as  an 
internal  services  provider  is  to  put  in  place 
the  metrics  to  demonstrate  that  services  pro¬ 
vided  internally  are  either  less  expensive  or 
better  than  those  provided  from  outsourcers. 


Another  reason  to  move  to  an  internal  ser¬ 
vices  provider  model  is  to  bridge  the  gap 
between  business  needs  and  telco  service 
offerings.  Carriers  try  hard  to  position  them¬ 
selves  as  partners,  they  often  don’t  under¬ 
stand  how  to  translate  a  customer’s  business 
requirements  into  the  right  mix  of  offerings, 
because  they  don’t  understand  the  nuances 
of  the  customer’s  business.  That’s  where  the 
internal  group  comes  in. 

Converting  your  team  to  an  internal  ser¬ 
vices  provider  is  more  challenging  than  it 
sounds,  however.  Only  around  60%  of  the 
folks  I  work  with  have  done  so  (and  those, 
with  varying  degrees  of  success).  Here’s  a 
quick  road  map  for  making  the  transition: 

Start  by  defining  your  metrics.  For  example, 
what  does  “better”  mean,  in  your  organiza¬ 
tion?  Higher  user  uptime?  Shorter  application 
response  time?  Faster  circuit  or  service  instal¬ 
lation  time?  Make  sure  you  fully  understand 
your  users’  needs  and  expectations  —  then 
quantify  them.  (Is  a  “prompt”  installation  mea¬ 
sured  in  months,  weeks,  days  or  hours?) 
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Similarly  how  are  you  defining  price?  Unit 
cost  per  bandwidth?  Overall  per-userTCO? 

Put  in  place  the  tools  to  measure  price  and 
performance  —  whether  yours  or  the  out¬ 
sourcers.  Some  of  my  clients  have  built  out 
such  sophisticated  cost  models  that  they’re 
able  to  tell  senior  management  exactly  how 
much  buying  a  company  (or,  say  opening  a 
suite  of  Asia  Pacific  offices)  will  cost  or  save 
in  telecom  services,  thus  enabling  business 
executives  to  factor  the  costs  and  benefits  of 
IT  into  their  business  decisions.This  also 
enables  you  to  realistically  assess  whether  an 
outsourcer  might  be  able  to  do  a  better  job, 
or  deliver  services  more  affordably  —  some¬ 
thing  it’s  best  to  know  up  front. 

Finally,  implement  a  chargeback  mecha¬ 
nism. The  most  common  approach  is  per- 
employee  chargeback  (between  a  quarter 
and  a  third  of  my  clients  use  this).  Communi¬ 
cations  teams  also  use  per-site,  per-business- 
unit  and  per-desktop  chargebacks,  among 
others. 

This  just  scratches  the  surface  of  what  it 
takes  to  become  an  internal  service  provider, 
but  hopefully  it  gives  you  a  sense  of  why  it’s  a 
good  idea. 

Johnson  is  president  and  senior  founding 
partner  at  Nemertes  Research,  an  independent 
technology  research  firm.  She  can  be  reached 
at  johna@nemertes.com. 
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Purdue  to  offer  IT  services 

University’s  PRF  DataStation  lets  businesses  lease  space  for  server  storage 


BY  BRAD  REED 

If  you’re  an  Indiana  business  looking  for  a 
low-cost  way  to  store  your  servers  and  connect 
your  company  through  fiber,  the  Purdue 
Research  Foundation  has  an  offer  for  you. 

The  foundation  announced  last  week  that 
its  PRF  DataStation  will  offer  IT  support  for 
the  140  businesses  that  are  located  in  the 
main  Purdue  Research  Park  in  West 
Lafayette,  Ind.  Essentially,  the  DataStation 
acts  as  a  local  network  carrier  that  delivers 
fiber-optic  connections  and  lets  companies 
in  the  area  lease  out  cabinet  space  to  store 
their  network  servers  and  related  IT  equip¬ 
ment.  Additionally,  the  station  will  offer  back¬ 
up  power  and  cooling  services,  as  well  as  a 
security  system  with  24-hour  video  surveil¬ 
lance,  storm  protection  for  data  systems  and 
a  fire  suppression  system. 

Eric  George,  a  PRF  systems  analyst,  says  the 
DataStation  employs  the  services  of  two 
statewide  fiber  providers,  a  local  exchange 
carrier  and  a  local  ISP  to  help  deliver  services 
to  its  clients.  Businesses  using  the  facility’s 
fiber  network  for  their  Internet  connections 
will  pay  based  on  the  amount  of  network  traf¬ 
fic  they  generate.  For  server  storage,  businesses 


Purdue's  PRF  DataStation  is  an  ener¬ 
gy-efficient,  high-security  facility 
built  to  house  mission-critical  com¬ 
puter  and  network  equipment. 

can  lease  a  full  40U  server  cabinet  for  $750  a 
month,  as  well  as  a  20U  half-cabinet  for  $400  a 
month,  he  says.  For  businesses  with  smaller 
storage  needs,  the  PRF  is  working  out  a  per-U 
pricing  plan  that  now  charges  a  negotiable 
rate  of  $100  a  month  per  lU,he  adds. 

“The  data  center  also  provides  assurance  for 
high  capacity  so  Web  traffic  doesn’t  slow  down 
during  peak  Internet  usage,”  George  says.“We’re 
also  using  a  carrier-neutral  approach,  which 


means  we  will  use  the  most  competitive  pric¬ 
ing  and  services  for  our  clients.” 

Eric  Olson,  a  consultant  for  the  PRpsays  the 
DataStation  is  planning  to  create  several 
branches  in  such  cities  as  Indianapolis  that 
will  deliver  DataStation  benefits  to  more 
Indiana  businesses. 

The  plan  is  to  expand  gradually  throughout 
northeast  and  southeast  Indiana  and  offer 
companies  in  those  areas  virtualized  applica¬ 
tions,  managed  services  and  off-site  datastor¬ 
age  capabilities,  he  says.  Even  so,  no  one 
should  expect  the  PRF  DataStation  to  expand 
into  a  nationwide  operation  anytime  in  the 
near  future,  he  adds. 

“We  are  expanding  on  a  case-by-case  basis 
to  other  companies,”  Olson  says.  “But  we  will 
still  be  more  of  a  local  data  center.” 

The  Purdue  Research  Parks  are  part  of  an 
initiative  by  Purdue  University  to  spur  high- 
tech  economic  growth  throughout  Indiana 
by  attracting  companies  that  specialize  in 
life  sciences,  homeland  security,  engineer¬ 
ing,  advanced  manufacturing  and  IT.  The 
PRF  maintains  research  parks  in  West 
Lafayette,  Indianapolis,  Merrillville  and  New 
Albany.  ■ 


Novell,  Red  Hat  upgrade  Linux  offerings 


BY  JOHN  FONTANA 

Novell  and  Red  Hat  updated  their  Linux 
operating  systems  last  week,  adding  improve¬ 
ments  in  virtualization,  desktops,  networking, 
management  and  hardware  support. 

Novell  released  SUSE  Linux  Enterprise  10 
Service  Pack  2  (SP2),  while  Red  Hat  shipped 
Version  5.2  of  Red  Hat  Enterprise  Linux 
(RHEL).Both  vendors  added  improvements  to 
the  desktop  and  the  server. 

There  were  many  areas  of  overlap,  especially 
with  virtualization. 

Novell  added  support  for  Xen  3.2  to  its  SUSE 
Linux  Enterprise  Server  (SLES)  server  plat¬ 
form,  and  support  for  fully  virtualized 
Windows  Server  2008  and  2003  platforms.  In 
addition,  Novell  now  supports  live  migration  of 
Windows  guests  across  physical  machines. 

Novell’s  support  of  the  Windows  platform  is 
an  outgrowth  of  a  cross-licensing  patent  deal  it 
signed  with  Microsoft  in  2006  and  an  interop¬ 
erability  lab  the  pair  opened  in  2007. 

Novell  also  updated  itsYaST  (Yet  another  Set¬ 
up  Tool)  to  ease  boot-ups  and  add  network 
module  support  for  new  devices. 

Red  Hat  also  focused  on  improving  its  virtu¬ 
alization  capabilities,  which  are  based  on  the 
same  Xen  hypervisor  technology  Novell  uses. 


“The  biggest  thing  for  us  is  that  some  limits 
went  away”  says  Daniel  Riek,  product  man¬ 
ager  for  RHEL.“We  now  support  more  CPUs 
and  [Non-Uniform  Memory  Access]-based 
architectures.” 

RHEL  5.2  now  can  handle  virtualized  sys¬ 
tems  with  as  many  as  64  CPUs  and  512GB  of 
memory  Red  Hat  also  boosted  security,  perfor¬ 
mance,  management,  and  power-savings  capa¬ 
bilities  for  newer  processors.  The  company 
added  new  drivers  for  RHEL  3  to  improve  its 
performance  as  a  guest  operating  system  run¬ 
ning  on  a  RHEL  5  host  server. 

The  two  vendors  also  made  a  number  of 
improvements  on  the  desktop. 

Novell  added  local  New  Technology  File 
System  file  support  to  improve  interoperability 
with  Microsoft  Windows  and  Office,  improved 
integration  with  Active  Directory,  and  up¬ 
graded  OpenOffice.org  2.4  Novell  Edition,  a 
set  of  productivity  applications. 

The  OpenOffice.org  improvements  include  a 
technical  preview  of  an  Office  Open  XML 
translator.  Novell  also  added  plug-and-play 
support  for  wireless  broadband  (Universal 
Mobile  Telecommunications  System  and  3G) 
and  Network  Manager  enhancements. 

The  RHEL  5.2  desktop  was  updated  with 


enhanced  support  for  laptop  power-manage¬ 
ment  features  —  suspend  or  hibernate  and 
resume;  updated  graphics  drivers;  and  updates 
to  desktop  applications,  including  OpenOffice 

2.3  and  Firefox  v3. 

Novell  also  unveiled  its  tool  called 
Subscription  Management  Tool  for  SUSE  Linux 
Enterprise  to  help  users  manage  update  distri¬ 
bution.  The  SP2  release  also  includes  updates 
to  Heartbeat  2  and  OCFS2  for  high  availability 
and  storage  management;  support  for  IPv6; 
support  for  IBM  cryptographic  hardware;  and 
enhancements  to  network,  storage  and  other 
drivers  for  better  hardware  compatibility  New 
real-time  support  features  include  adaptive 
locking,  OpenFabrics  Enterprise  Distribution 

1.3  and  the  Precise  Timing  Protocol. 

Novell  also  updated  several  tools  in  its 
SUSE  Linux  Enterprise  Software  Devel¬ 
opment  Kit,  including  KIWI,YaST2  Product 
Creator,  YaST2  Add-on  Creator  and  YaST2 
Image  Creator. 

Red  Hat  upgraded  hardware  support  for 
x86  and  x86-64,  Itanium,  IBM  Power,  and  IBM 
System  z,The  company  also  added  support 
for  IPv6  and  IPSec;  updated  storage,  network 
and  graphics  drivers;  and  certified  IBM’s  Cell 
Blade  System.  ■ 
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Where’s  the  in  IT-GRG? 


BY  DON  GRAY  AND  JON  HEIMERL 

oftware  suites  that  integrate  governance,  risk  and  compliance  tools 
(usually  referred  to  as  IT-GRC)  are  being  hyped  by  vendors  and  abet¬ 
ted  by  analysts  as  the  next  great  wave  of  IT  management  solutions. 


Combining  these  functions  under  one  roof, 
IT-GRC  packages  promise  to  enable  corporate 
management  to  ensure  the  organization  is 
meeting  enterprise  risk-management  goals 
and  complying  with  requirements  set  by  regu¬ 
lators  and  business  partners. 

But  just  as  the  best  financial-management 
systems  and  a  bevy  of  auditors  have  not  sub¬ 
stantially  stopped  the  flow  of  financial  malfea¬ 
sance  and  misconduct,  this  promise  also  will 
fundamentally  miss  the  mark  unless  the  issue 
of  security  is  addressed. 

As  evidenced  most  recently  in  the 
Hannaford  data  breach  incident,  in  which  an 
estimated  4.2  million  payment  card  holders 
had  their  trust  violated  through  a  security  flaw, 
an  organization  can  have  a  risk-management 
program  and  a  compliance  program  and  still 
not  be  secure. 

Hannaford,  according  to  public  statements, 
used  an  IT-GRC  package  to  manage  its  risk  and 
compliance  program,  had  undertaken  and 
passed  outside  assessments  and  audits,  and 
from  all  outside  appearances,  had  been  doing 
“the  right  things.”  But  if  having  a  risk-manage¬ 
ment  and  compliance  program  can’t  prevent 
a  very  public  and  costly  data  breach,  what  is 
the  point?  How  many  dollars  spent  on  those 
programs  would  have  been  better  spent  on 
addressing  the  fundamentals  of  security? 

After  the  breach  was  publicized,  Hannaford 
President  and  CEO  Ronald  C.  Hodge  said  in  a 
statement:  “We  have  taken  aggressive  steps  to 
augment  our  network  security  capabilities.” 

Section  4.1  of  the  Payment  Card  Industry 
(PCI)  Standard  reads:“Encrypt  transmission  of 
cardholder  data  across  open,  public  networks 
....  Sensitive  information  must  be  encrypted 
during  transmission  over  networks  that  are 
easy  and  common  for  a  hacker  to  intercept, 
modify,  and  divert  data  while  in  transit.” 

Is  it  reasonable  to  believe  that  internal  net¬ 
works  are  significantly  less  vulnerable  to 
attack  than  public  networks?  Yes.  Is  it  true  in 

Got  great  ideas? 

■  Network  World  is  looking  for  great 
ideas  for  future  Tech  Updates.  If  you've 
got  one,  and  want  to  contribute  it  to  a 
future  issue,  contact  Editor  in  Chief 

John  Dix  Gdix@nww.com) 


the  real  world  of  the  large  distributed  net¬ 
work?  Probably  not. 

Compliance  is  not  security  and  risk  manage¬ 
ment  does  not  automatically  provide  risk 
reduction. 

Many  security  firms  have  been  telling  enter¬ 
prises  for  years  that  the  best  way  to  address  IT 
compliance  and  risk  is  to  assess  where  the 
organization’s  security  program  is  from  a 
maturity  standpoint  and  then  use  compliance 
requirements  and  risk  objectives  to  inform 
and  advise  the  actions  they  need  to  move 
their  security  program  where  it  needs  to  be. 

The  best  IT  shops  know  that  the  way  to  opti- 

Without  the  full  inclusion  of 
an  organization’s  security 
staff,  compliance  and  risk- 
management  efforts  will  con¬ 
tinue  to  fall  short,  and  it  will 
only  become  evident  after 
the  fact  that  carts  should  not 
drive  horses. 

mize  the  scarce  resources  at  their  disposal  is 
to  include  security  in  the  architecture  and 
design  process,  make  the  most  of  the  security 
features  and  functions  available  in  the  prod¬ 
ucts  and  tools  they  are  using,  and  judiciously 
apply  additional  capital  and  outside  assis¬ 
tance  for  new  functionality  and  the  tasks  they 
cannot  or  would  rather  not  do  themselves. 

However,  without  a  firm  understanding  of 
where  their  security  program  stands  in  terms 
of  IT  frameworks  such  as  ISO  or  CobIT/COSO, 
and  in  terms  of  their  industry  peers,  security 
efforts  tend  to  be  misdirected,  piecemeal, 
wrong-sized  or  inefficient. 

Without  the  full  inclusion  of  an  organiza¬ 
tion’s  security  staff,  compliance  and  risk-man¬ 
agement  efforts  will  continue  to  fall  short,  and 
it  will  only  become  evident  after  the  fact  that 
carts  should  not  drive  horses. 

Consider  the  approach  to  security  of  two 
companies  that  are  in  similar  industries  and 
have  comparable  security  budgets  for  their 
compliance  and  security  program  projects 
(see  table).  Company  A  spent  its  time  and 
resources  to  explicitly  prepare  for  a  Sarbanes- 


Standard 

Company  A 

Company  B 

SOX 

80% 

65% 

ISO 

41% 

75% 

PC1 1.1 

27% 

70% 

HIPAA 

46% 

83% 

Oxley  (SOX)  audit.  All  attention  on  the  securi¬ 
ty  controls  was  designed  to  make  the  compa¬ 
ny  more  compliant  with  SOX  requirements. 
Company  B  spent  its  time  and  resources  in 
more  general  management  of  its  overall  secu¬ 
rity  program.  Attention  on  its  security  controls 
was  designed  to  improve  the  company’s  over¬ 
all  security  program. 

Both  companies  achieved  their  specific 
goals  but  received  different  results.  Consider 
assessment  results  performed  on  the  two  orga¬ 
nizations  after  similar  amounts  of  resources 
were  expended.  The  assessment  shows  com¬ 
pliance  results  against  a  reasonable  set  of 
standards  after  each  company  completed  its 
project  work. 

Company  A  achieved  good  results,  becom¬ 
ing  about  80%  compliant  with  the  appropri¬ 
ate  SOX  requirements.  For  the  resources  and 
time  spent,  this  was  a  reasonable  result  for 
the  company,  and  it  considered  the  project  a 
success. 

However,  for  about  the  same  amount  of  time 
and  resources,  Company  B  came  within  20% 
of  the  same  level  of  compliance  with  SOX 
requirements,  but  made  significant  compli¬ 
ance  inroads  with  the  other  standards.  Which 
of  the  two  companies  has  the  better  enter¬ 
prisewide  security  program? 

IT-GRC  packages  present  an  image  of  a 
smoothly  integrated  IT  function  acting  in  har¬ 
mony  with  the  wants  and  needs  of  the  enter¬ 
prise.  And  once  this  new  market  segment  exits 
the  “peak  of  inflated  expectations”  phase  of 
Gartner’s  hype-cycle,  these  types  of  solutions 
will  present  a  fine  tool  that  can  aid  enterprises 
in  managing  IT. 

But  a  house  is  still  only  as  good  as  its  foun¬ 
dation.  Many  organizations  would  be  better 
served  ensuring  that  their  security  program  is 
of  a  sufficient  maturity  before  trying  to  add  yet 
another  layer  of  management  and  technology 

Gray  is  vice  president  of  technical  strategy 
and  Heimerl  is  director  of  SecurCompass  devel¬ 
opment  for  Solutionary,  a  provider  of  managed 
security  solutions,  compliance  and  security 
measurement,  and  security  consulting  services. 
They  can  be  reached  at  Dongrayfatsolution¬ 
ary,  com  and  Jonheimerl@solutionary.com, 
respectively. 
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Updating  Twitter  with  cURL  and  Wget 

j 


Mark  Gibbs 


ust  in  case  you  are  a  complete  noob.let  me 
explain  one  of  the  hottest  social  networking 
tools,  a  micro-blogging  service  called 
Twitter. Twitter  lets  you  post  messages  of  as  many 
as  140  characters  (from  your  browser  or  a  vari- 
GEARHEAD  ety  of  applications)  that  can  be  seen  either  by 
the  whole  Twitter  world  or  by  select  Twitter  users. 
You  can  follow  what  everyone  is  posting  or  just 
follow  your  Twitter  friends. 

So,  first  up  this  week  is  a  service  that  all  Twitterholics  would  love  if  it 
worked  properly:  istwitterdown.com.  The  home  page  of  istwitterdown 
reads  “Yes”  or  “No”  depending  on  the  status  of  Twitter.com.  Sounds  cool, 
but  all  it  seems  to  be  telling  you  is  whether  the  server  is  responding  to 
pings,  which  is  quite  different  from  whether  Twitter  is  working  properly 
which,  at  the  time  of  writing,  it  isn’t.  Again.  Come  on  Twitter,  1  know  it 
seems  like  rocket  science,  but  really . . . 

We’ll  come  back  to  how  istwitterdown  should  work. 

Anyway  next  up,  a  command-line  Twitter  client.  In  a  corporate  context 
this  is  something  that  you  might  want  to  use  to  broadcast  a  “tweet”  (that’s 
what  Twitter  messages  are  called)  for  events  such  as  status  updates  for  a 
service  or  device.  The  Twitter  REST-based  (Representational  State 
Transfer)  API  is  relatively  simple,  and  to  post  a  tweet  all  you  need  to  per¬ 
form  is  a  straightforward  HTTP  POST  request. 

An  easy  way  to  post  to  tweet  from  a  command  line  is  to  use  cURL,  a 
free  open  source  tool  that  lets  you  use  a  URL  format  to  perform  data 
transfers.CURL  is  overblessed  with  features  and  can  handle  the  major 
protocols,  including  HTTP  HTTPS,  FTP  FTPS  and  even  LDAP  and  Telnet. 
Better  still,  cURL  is  available  for  a  large  number  of  operating  systems. 

To  post  to  Twitter  you  need  an  account  because  the  API  requires  you 
to  authenticate.  Using  cURL  in  a  command  or  terminal  window,  enter 


(this  command  should  be  on  a  single  line  and  the  variables  are  under¬ 
lined):  curl  -u  emaikpassw  -d  status=”text”  http://twitter.com/statuses/ 
update.xml. 

CURL  figures  out  which  protocol  to  use  from  the  URL  you  provide, and 
when  “http:”  is  specified  will,  unless  otherwise  instructed  (using  -0), 
default  to  using  HTTP  1 . 1  .The  first  argument, -u, instructs  cURL  to  use  the 
next  two  parameters  (separated  by  a  colon)  as  the  account  name  and 
password  for  basic  authentication.  The  next  argument,  -d,  specifies  the 
data  (maximum  140  characters)  to  be  sent  via  a  POST  request. 

A  cURL  expects  a  response  to  the  POST  request  so  the  result  will  be 
the  requested  page  (update.xml)  sent  to  stdout.This  page  will  be  encod¬ 
ed  according  to  the  file  type  used  in  the  request,  thus  as  we  just  request¬ 
ed  update.xml  we’ll  get  XML-formatted  data.  The  alternatives  are  JSON 
(JavaScript  Object  Notation),  RSS  and  Atom  formats. 

You  could  do  the  same  exercise  using  GNU  Wget.  Wget,  which  runs  on 
Windows,  MSDOS, VMS  and  Solaris,  is  similar  to  cURL  but  with  fewer  fea¬ 
tures  and  a  more  complex  syntax.  This  is  the  same  Twitter  posting  as 
above  in  Wget  format  (this  command  should  also  be  on  a  single  line): 
wget  — keep-session-cookies  — http-user=email  — http-password=passw 
— post-data=”status=text”  http://twitter.com:80/statuses/update.xml. 

Unlike  cURL, Wget  sends  the  output  to  a  file  named  for  the  target  of  the 
request  (here  it  would  be  update.xml). 

So,  how  should  istwitterdown.com  work?  Rather  than  just  pinging  the 
server,  it  should  set  up  a  Twitter  account  and,  using  a  query  similar  to 
those  above,  perform  an  update  and  check  the  return  code.  The  code 
will  show  that  the  service  will  respond  or  the  Web  server  will  report  that 
the  server  isn’t  running  or  you’ll  get  a  timeout.  How  hard  is  that? 

Gibbs  tells  it  like  it  is  in  Ventura,  Calif.  Follow  him  on  Twitter  as  quistu- 
ipater.Tell  gearhead@gibbs.com. 


Digital  camera  has  Wi-Fi  connectivity 
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The  scoop:  Lumix  DMC-TZ50  digital  camera, 
by  Panasonic,  about  $450. 

What  it  is:  A  9.1-megapixel  digital  camera  that 
includes  built-in  Wi-Fi  network  connectivity 
which  lets  users  upload  photos  directly  to 
Google's  Picasa  photo-sharing  service  instead  of 
having  to  connect  to  a  PC.The  camera  also  can 
connect  directly  to  a  T-Mobile  HotSpot  for  upload¬ 
ing  photos  (the  device  comes  with  one  year  of 
free  service),  and  can  connect  at  a  user's  home  Wi-Fi  networks  (which  is 
made  even  easier  if  users  utilize  the  T-Mobile 
HotSpot@Home  service. 

The  camera  features  a  28mm  wide-angle  Leica 
lens,  a  lOx  optical  zoom  and  a  very  bright  3-inch 
LCD  screen  for  viewing  photos  that  you've  taken. 

The  camera  can  record  video  at  720-pixel  resolution 
and  content  can  be  stored  on  an  SD  card. 

Why  it's  cool:  Unlike  the  Eye-Fi  card  (which  Mark 
Gibbs  reviewed  last  week  in  Gearhead),  the  Wi-Fi  is 
built  into  the  digital  camera;  no  separate  cards  or 
equipment  are  required.  There's  even  a  dedicated 
Wi-Fi  setting  on  the  camera's  feature  dial  to  put  you 
easily  into  Wi-Fi  mode. 

For  users  who  are  always  within  range  of  a  Wi-Fi 
network  (either  at  home  or  through  the  T-Mobile  hot  spots),  using  this 
camera  is  a  very  quick  way  to  get  photos  uploaded  to  Picasa  for  shar¬ 
ing  with  others.  If  you're  not  within  range  of  aWi-Fi  network, you  can  still 
save  the  photos  on  the  SD  card  and  transfer  them  in  more  traditional 
ways  (either  via  USB  cable  or  SD  card  reader). 

The  regular  features  on  the  digital  camera  also  are  very  nice  —  the  lOx 
optical  zoom  lets  you  get  closer  to  objects  without  having  to  be  right  next 


Built-in  Wi-Fi  makes  the  TZ50  a 
gem. 


to  them,  and  the  3-inch  display  gave  me  awesome  views  of  the  photos  I 
took.The  display  is  so  good  that  it  deceived  me  into  thinking  I  was  a  bet¬ 
ter  photographer  —  only  after  I  uploaded  the  images  to  Picasa  did  I  see 
that  some  of  the  shots  needed  to  be  corrected  for  color  or  brightness. 

The  camera's  Intelligent  Auto  mode  is  great  for  nonprofessional  pho¬ 
tographers.  The  technology  is  a  group  of  functions  such  as  face  detec¬ 
tion,  intelligent  exposure  and  scene  selectors,  which  make  for  the  best 
possible  photos. 

Some  caveats:  The  camera  cannot  connect  to  Wi-Fi  networks  that 
require  browser-based  authentication.  Because  there's  no  browser  on 
the  camera,  connections  to  networks  that  require 
a  browser  were  not  possible.  This  is  a  shame,  be¬ 
cause  business  users  would  benefit  from  a  digital 
camera  that  could  connect  quickly  to  a  corporate 
Wi-Fi  network  for  uploading,  eliminating  the  need 
to  transfer  photos  via  USB  or  memory  card  reader. 
Flopefully  Panasonic  can  find  a  way  to  get  the 
camera  to  connect  to  more  networks  other  than 
home  networks  and  T-Mobile  HotSpots. 

I  also  experienced  a  couple  of  system  glitches 
—  there  were  times  when  I  couldn't  access  my 
home  network,  experiencing  an  IP  address  allo¬ 
cation  error  (without  much  explanation  on  the 
camera's  part). 

Bottom  line:  The  future  is  bright  for  Wi-Fi  on  digital  cameras,  and  this 
model  is  leading  the  way.  If  Panasonic  can  find  ways  to  get  access  to 
additional  Wi-Fi  networks  (especially  corporate  networks),  mobile 
workers  who  take  a  lot  of  photos  will  find  this  a  must-have  tool. 

Grade:  ★★★★★  (out  of  five). 

Shaw  can  be  reached  at  kshaw@nww.com. 
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Centralizing  device,  network  and  application  management  is  an  IT  imperative 
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BY  CHRIS  SILVA  AND  BENJAMIN  GRAY, 
ANALYSTS,  FORRESTER  RESEARCH 

obile  technology  is  deliv¬ 
ering  real  business  bene¬ 
fits,  but  the  growing  com¬ 
plexity  and  the  way  the  technol¬ 
ogy  is  acquired  and  managed 
can  stretch  IT  thin. 

These  are  the  main  findings  of  a  survey  of 
531  mobility  decision-makers  at  North 
American  businesses  by  Forrester  Research, 
in  association  with  Network  World,  which  set 
out  to  examine  the  current  mobile  environ¬ 
ment  and  the  organizational  structure 
needed  to  push  mobility  forward. 

While  challenges  lie  ahead,  the  survey 
revealed  broad  agreement  that  mobil¬ 
ity  is  paying  dividends.  Specifically, 
respondents  said  mobile  devices 
i  improve  user  flexibility  (43%  of  re- 
I  spondents);  response  time  to  internal 
issues  (42%);  and  response  time  to 
customer,  partner  and  other  external- 
party  issues  (38%). 

The  trick  will  be  to  gain  even  greater 
benefits  as  the  technology  matures  and 
changes,  which  will  require  more  central¬ 
ized  strategy  and  control  than  are  common 
today. 

Change  is  coming  whether  companies 
are  ready  for  it  or  not.  The  shift  from  desk¬ 
tops  to  laptops  continues,  with  half  of  the 
survey  respondents  reporting  they  expect 
to  issue  mobile  PCs  to  up  to  three-quarters 
of  their  employees  in  2013  (see  graphic). 
But  the  biggest  change  will  come  with 
handhelds. 

Users’  mobile  device  preferences  —  tradi- 


m 
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tional  mobile  phones,  PDAs  and  smart¬ 
phones  included  —  are  shifting  from  voice¬ 
centric  to  data-centric  devices.  Today,  41% 
of  respondents  use  smartphones,  but  this 
percentage  will  double  over  the  next  five 
years  (see  graphic)  and  result  in  more  data 
and  more  business-critical  applications  to 
manage  and  secure. 

Which  mobile  operating  systems  do  these 
shops  support?  It’s  a  mixed  bag  and  won’t 
change  any  time  soon:  74%  support 
Research  In  Motion’s  BlackBerry,  53%  sup¬ 
port  various  flavors  of  Microsoft’s  Windows 
Mobile,  and  40%  run  Palm  OS-powered 
Treos  or  Centros  (see  graphic).  Apple’s  Mac 
OS  X-powered  iPhone  also  has  established 
a  critical  beachhead,  with  12%  of  the 
respondents  saying  they  support  iPhones. 

Looking  five  years  out,  respondents  are 
predicting  an  equally  diverse  landscape. 
Almost  three-quarters  say  they  are  “very 
likely”  or  “likely”  to  support  BlackBerry,  66% 
plan  to  support  Windows  Mobile,  and  22% 
will  support  Apple’s  Mac  OS  X  and  Linux 
(on  which  Google’s  Android  mobile  operat¬ 
ing  system  is  based). 

This  mixed  environment  and  the  increas¬ 
ing  sophistication  of  devices  add  up  to 
trouble  for  the  IT  department,  which  is  los¬ 
ing  insight  into  device  capabilities  and 
security  levels,  as  well  as  the  ability  to  man¬ 
age  and  sync  mobile  and  corporate  re¬ 
sources.  Supporting  this  model  will 
become  too  cumbersome  for  IT  shops 
already  spread  thin  by  cost-cutting. 

It  gets  even  worse  when  you  consider  the 
network  diversity  IT  must  contend  with. 
Fifty-one  percent  of  the  survey  respondents 
say  they  have  a  range  of  802.1 1  Wi-Fi  tech¬ 
nologies,  and  75%  support  access  to  exter¬ 
nal  wireless  networks  for  connecting  to 
business  applications  outside  the  office. 
The  future  points  to  even  more  WAN 
options,  as  carriers  investigate  everything 
from  WiMAX  to  4G  wireless  technologies. 

So,  what’s  the  good  news?  Adoption  of 
mobile  technology  —  in  many  companies, 
still  in  its  early  phases  —  is  showing  im¬ 
pressive  returns.  Pairing  mobility’s  ROl  with 
a  strong  plan  for  its  infrastructure  owner¬ 
ship  and  management  will  help  organiza¬ 
tions  get  the  most  out  of  the  technology. 

Central  control  key  to  returns 

Central  control  is  a  critical  factor  in  IT 
organizations’  benefiting  from  investments 
in  mobile  devices,  networks  and  applica¬ 
tions.  Device  preference  and  the  use  of 
internal  and  external  wireless  networks 
were  relatively  homogeneous  across  the 
organizations  surveyed,  but  the  way  com¬ 
panies  procure  and  support  mobility  was 
more  company-specific. 

Three-quarters  of  the  organizations  are 
supplying  mobile  devices  and  service  to 
the  employees  IT  is  chartered  to  support. 
This  is  the  simplest  way  to  gain  jurisdiction 
over  the  devices  and  services  users  adopt, 
but  there  are  always  exceptions  to  the  rule. 
The  most  common  factor  determining  who 
gets  a  device  —  used  by  two-thirds  of 
respondents  —  is  job  title.  Breaking  down 
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Smartphone  explosion 
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What  handheld  operating  systems  do  you  support? 


BlackBerry  Windows  Palm  OS  Windows  Windows  Mac  OS  X  Symbian  Linux  Other 
Mobile  6.x  Mobile  5.x  CE  (iPhone)  (Android) 
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titles,  the  complexity  of  device  provision  is 
even  more  apparent. 

in  short,  it’s  unclear  whether  many  com¬ 
panies  have  a  consistent  approach  to 
device  procurement,  management  and 
security.  Forrester  sees  a  trend  among 
organizations  in  which  service  procure¬ 
ment  —  the  process  by  which  contracts 
with  cellular  carriers  are  managed  —  is 
controlled  by  a  separate  department.  This 
separation  creates  a  dissonance  between 
devices  and  services,  and  can  manifest 
itself  as  a  mismatched  set  of  capabilities 
as  business-critical  applications  are  rolled 
out  to  users. 

Mobile  operations,  a  new  IT  role 

To  get  the  most  out  of  their  mobility 
investments,  Forrester  recommends  that 
companies  create  a  new  IT  role,  that  of 
mobile  operations.  Forrester  defines  a 
mobile-operations  professional  as  “a  single 
coordinator  for  managing  mobile  networks 
internal  and  external  to  the  organization, 
device  choice  within  the  organization,  and 
ensures  that  those  devices  are  properly 
secured  and  managed.” 

The  formation  of  this  role  should  not  rep¬ 
resent  a  major  departure  from  existing  prac¬ 
tices. The  survey  found  that  75%  of  organiza¬ 
tions  now  place  management  of  PCs  and 
mobile  devices  within  the  same  group,  and 
another  14%  expect  to  consolidate  the 
groups  within  five  years.  The  key  considera¬ 
tions  in  the  formation  of  a  mobile-opera¬ 
tions  role  are  to  include  and  align  all  ele¬ 
ments  that  are  critical  to  ensuring  mobility 
continues  to  benefit  the  organization. 

Mobile-operations  professionals  should 
manage  the  following  tasks: 

PC  and  handheld  device  configuration. 
The  growing  capabilities  of  mobile-device 
management  tools  ultimately  will  move  IT 
closer  to  a  future  in  which  device  choice  is 
in  the  hands  of  the  user.  We’re  not  there  yet, 
however.  Device  configuration  —  ensuring 
a  device  is  secured  and  managed  —  is  a 
critical  and  central  component  of  IT  opera¬ 
tions.  Such  trends  as  client  virtualization 
will  reshape  PC  selection,  and  major  con¬ 
sumer-oriented  operating-system  initiatives 
will  shake  up  handheld  devices,  even  in 
businesses. 

Device  management  and  security.  In¬ 
cluding  the  most  popular  device  platforms 
is  key  to  the  device  selection  process.  As  a 
result,  the  individuals  playing  a  central  role 
in  device  selection  should  be  the  same 
individuals  using  the  tools  that  manage  and 
secure  them.  In  addition  to  acting  as  a  clear¬ 
inghouse  for  more-advanced  device¬ 
support  issues,  a  centralized  management 
authority  provides  device  remediation  and 
security,  which  are  useful  for  audit  and  com¬ 
pliance  processes. 

Carrier  relationships.  This  is  perhaps  the 
one  area  that  IT  departments  don’t  take  into 
account  when  selecting  devices.  In  many 
businesses,  this  function  is  completely  sepa¬ 
rate  from  the  IT  department,  and  that’s  a 
structure  that  won’t  work  moving  forward. 
Mobile  operations  becomes  even  more  crit- 
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Use  of  handhelds 

Handheld  devices  are  being  used 
by  more  employees  at  all  levels. 


Neutral 

17% 


Strongly 
agree 

22% 


Strongly  disagree  2% 


Agree  47% 


Employee  requests  for  handhelds 

Employees  who  do  not  have 
handhelds  are  requesting  that  the 
organization  purchase  them  for 
work-related  purposes. 


Strongly 
agree 


Agree  42% 


We  will  provide  handhelds 


Strongly 
25% 


Agree  51% 


ical  with  the  arrival  of  dual-mode  devices 
that  can  access  both  an  internal  IP  PBX  and 
a  carrier  network. 

In  addition,  mobile-operations  profession¬ 
als  should  remain  actively  involved  in  man¬ 
aging  these  activities: 

Mobile  application  development.  The 
mobile-operations  professional  should  be 
consulted  and  kept  informed  of  develop¬ 
ment  initiatives  that  probably  will  affect  the 
selection  of  handhelds  and  mobile  PCs. 
Developers  should  rely  on  the  mobile- 
operations  manager  to  provide  capability 
benchmarks  for  systems  in  use,  insight  into 
future  capabilities  and  guidance  on  refresh 
cycles. 

Sharing  these  responsibilities  should  aid 
developers  in  creating  applications  that 
take  advantage  of  platform  capabilities  or 
specific  elements  of  the  devices,  and 
should  aid  mobile-operations  personnel 
because  they  will  have  some  control  over 
and  insight  into  the  applications  they’re 
pushing  to  mobile  devices. 

Internal  mobile  network  deployments.  In 
addition  to  selecting  the  external  networks 
and  leading  the  configuration  of  devices, 
the  mobile-operations  professional  should 
play  a  lead  role  in  the  timing  and  rollout  of 
next-generation  technology  (for  example, 
802.1  In  Wi-Fi  networks).  That  will  make  it 
possible  to  roll  out  devices  supporting 
faster  throughput  —  but  not  before  all  secu¬ 
rity  and  management  challenges  have  been 
solved. 

Consolidating  siloed  roles 

Developing  internal  resources  to  fill  the 
mobile-operations  position  should  be  a 
gradual  process  that  ends  with  the  central¬ 
ization  of  all  things  mobile.  If  this  hasn’t 
been  done  already,  the  process  should 
begin  by  pairing  device  decision-making  to 
PCs  and  mobile  devices.  This  will  help 
ensure  a  company  is  not  funding  duplicate 
capabilities. 

As  mobile  use  expands,  tracking  the  use 
of  mobile  devices  and  applications  will 
allow  ongoing  trend  analysis  and  help 
companies  prepare  for  what’s  ahead.  A  cen¬ 
tral  function  for  supporting  mobile  devices 
will  also  let  IT  departments  support  users 
better. 

The  IEEE  has  created  the  Wireless  Com¬ 
munication  Engineering  (WCET)  Technolo¬ 
gies  Certification  program  to  develop  and 
certify  IT  professionals  in  the  wireless  tech¬ 
nologies  on  which  mobile  networks  are 
based.  This  program  will  serve  as  a  good 
baseline  for  the  capabilities  of  future 
mobile-operations  candidates.  It  was  just 
launched,  however,  so  don’t  expect  to  see 
certified  professionals  circulating  in  the 
workforce  anytime  soon. You’ll  be  better  off 
marching  ahead  with  your  own  mobile 
operations  strategy  in  the  near  term,  and 
leverage  WCET  as  you  look  to  expand  the 
function  in  the  future. 

Silva  and  Gray  are  analysts  at  Forrester 
Research.  They  can  be  reached  at  csilva@ 
forrester.com  and  bgray@forrester.com. 
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Server  Technology 

Solutions  for  the  Data  Center  Equipment  Cabinet 

Basic  CDU 

>  Reliable  &  Economical 

Metered  CDU 

>  Local  Input  Current  Monitoring 

>  Simple  3-Phase  Load  Balancing 

Smart  CDU 

>  Local  Input  Current  Monitoring 

>  Supports  External  Temp.  &  Humidity  Probes 

>  Secure  IP  &  Serial  Monitoring  of  Power, 
Temperature  &  Humidity 

Switched  CDU 

>  Local  Input  Current  Monitoring 

>  Supports  External  Temp.  &  Humidity  Probes 

>  Secure  IP  &  Serial  Monitoring  of  Power, 
Temperature  &  Humidity 

>  Remote  Power  Control  for  Each  Outlet: 
ON/OFF/Reboot  with  Graceful  Server  Shutdown 

>  Smart  Load  Shedding 

>  kW  per  In-Feed,  Per  Cabinet,  or  Per  Square  Feet 
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Search  Terabytes  of  Text 


♦  over  two  dozen  indexed,  unindexed,  fielded  data  and  full-text  search  options 

♦  supports  hundreds  of  international  languages 

♦  file  parsers  /  converters  for  hit-highlighted  display  of  a[l  popular  file  types 

♦  Spider  supports  static  and  dynamic  web  data;  highlights  hits  while  displaying 
links,  formatting  and  {images  intact 


♦  API  supports  .NET,  C++,  Java,  SQL,  etc.  New  .NET  Spider  API 


The  Smart  Choice  for  Text  Retrieval®  since  1991 
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♦  "Bottom  line:  dtSearch  manages  a  terabyte  of  text  in  a  single  index 

and  returns  results  in  less  than  a  second"  —  InfoWorld 

♦  "For  combing  through  large  amounts  of  data,"  dtSearch  "leads  the  market" 

-  Network  Computing 

♦  dtSearch  "covers  all  data  sources  ...  powerful  Web-based  engines"  -  eWEEK 

♦  dtSearch  "searches  at  blazing  speeds"  -  Computer  Reseller  News  Test  Center 

See  www.dtsearch.com  for  hundreds  more  reviews, 
and  hundreds  of  developer  case  studies 


Contact  dtSearch  for  fully-functional  evaluations 
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Control  IT  ...with  Xtensys  ! 
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Configure  any  port  for  CAT5/5e/6/7  or  serial  devices 
Video  resolution  up  to  1920  x  1440 
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Space  saving  micro-mini  KVM  transmitter 
Advanced  security  features 
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Digital  KVM  IP 
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Multi-platform 
KVM  switches 

Switch  &  control  1,000s 
of  computers  and  network 
devices 


Micro-mini  CATx 
KVM  extender 

Extends  keyboard,  video, 
and  mouse  up  to  1,000' 
over  CATx 


KVM  Extenders 
CATx,  Fiber 

Extends  keyboard,  video, 
and  mouse  signals  up  to 
33,000  feet 


KVM  Rack  Drawers 
15",  17",  19"  or  20' 

The  most  efficient  way  to 
organize  your  server  room. 


Real-time  mouse  control 
Res.  up  to  1280  x  1024 
Secure  encrypted  operation 
Single  or  Dual  access 


Advanced  security 
High  resolution 
On-screen  menu 
USB,  PS/2,  Sun,  Serial 


PS/  2,  USB  or  both 
High  resolution 
SVGA,  VGA,  XGA,  RGB 
Video  skew  adjustments 


Fiber,  CATx 
DVI,  VGA,  High  Res. 
PS/2,  USB,  Sun 
Audio,  Serial 


1U  or  2U,  VGA,  DVI 
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PS/2,  USB,  or  Sun 
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•Supports  10/100/1000 

•  Stream  into  two  different  devices 

•  Rack  mount  up  to  three  across 

•  Supports  all  commercial  analysis  systems 

•  Also  works  with  open-source  tools 
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256  MB . 
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NEW! 
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$1,795 
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Learn  more.  Visit  www.networkTAPs.com. 


Choose  from  a  variety  of  configurations,  options,  and  pricing.  Plus  a 
complete  line  of  copper  and  optical  nTAPs  for  full-duplex  analyzer  systems. 
Free  overnight  delivery  * 
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The  Model  135  Site  Monitor  is  designed  to  serve  as  your 
"resource  kit”  for  monitoring  and  maintaining  computer, 
communications,  and  specialized  equipment  locations. 
With  a  wide  range  of  built-in  capabilities,  it’s  easy  to 
tailor  a  powerful  site-specific  solution. 

Highlights  include  10/100  Ethernet  and  analog  modem 
connectivity,  serial  port  access  and  text  data  "matching, 
AC  and  DC  voltage  monitoring,  ping  testing,  and  contact 
closure  inputs  and  outputs.  And  the  web-based  interface 
makes  setup  and  use  a  straight-forward  process. 

For  complete  details  on  the  Model  135,  give  us  a  call 
or  visit  www.gkinc.com. 
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find  out,”  said  Patrick  Lefemine,  CISO  at 
Hartford,  Conn.-based  firm  Lincoln  Financial 
Group,  another  Vontu  user. 

Lefemine  acknowledged  the  initial  piloted 
use  of  DLP  “scared  the  hell”  out  of  both  man¬ 
agement  and  IT  staff,  especially  the  time  it 
spotted  the  CEO’s  salary  Social  Security  num¬ 
ber  and  home  address  being  inadvertently 
transmitted.  “That  got  us  the  funding  for  this 
project,”  he  added. 

Lefemine  said  one  of  the  toughest  realiza¬ 
tions  imparted  by  the  hard  wisdom  of  DLP  was 
the  need  to  stop  sharing  even  a  single  unen¬ 
crypted  Social  Security  number  with  business 
partners  —  a  demand  pressed  by  Lincoln 
Financial  Group’s  audit  department  after  it  dis¬ 
covered  how  powerful  DLP  was  in  monitoring 
content. 

Rhonda  MacLean,  global  information  secu¬ 
rity  officer  at  Barclays  Bank,  said  use  of  the 
Vontu  DLP  highlighted  the  difficulty  of  con¬ 
forming  to  the  many  cross-border  data-flow 
regulations  of  Europe  and  elsewhere. 

“The  problem  has  gotten  more  complex,” she 
said,  noting  Barclays  Bank  operates  in  67 
countries.“One  incident  could  [set  in  motion] 
regulation  dominoes.” 

MacLean  said  one  drawback  Barclays  has 
noticed  in  its  DLP  installation  is  that  it’s  “CPU¬ 
intensive”  and  might  impact  some  real-time 
communications.  But  she  also  noted  DLP’s 
broader  capabilities  are  only  beginning  to  be 
explored  as  a  tool  to  monitor  how  business 
partners,  such  as  outsourcing  firms  or  call  cen¬ 
ters,  treat  sensitive  data  that’s  shared.“You  have 
to  be  able  to  put  in  your  own  castle  walls  with 
your  business  partners,”  she  said. 

Symantec  Vontu  isn’t  the  only  DLP  in  town. 
The  range  of  host-  and  network-based  content¬ 
monitoring  products  (also  sometimes  called 
data-leak  prevention  or  data-loss  protection)  is 
growing,  including  those  from  McAfee, 
Proofpoint,  Reconnex,Verdasys,  Vericept  and 
Websense.And  EMC,  which  last  year  acquired 
Tablus.is  now  partnering  with  Cisco  on  DLP 

MedStar  Health,  which  operates  hospitals  in 
the  Washington,  D.C.,  area,  two  years  ago 
deployed  the  Reconnex  gear  in  its  Maryland 
data  center  area  to  make  sure  that  no  patient 
healthcare  data  covered  under  the  federal 
Health  Insurance  Portability  and  Account¬ 
ability  Act  would  leak. 

But  according  to  Ron  Baklarz,  the  former 
director  of  information  systems  there  (and 
now  Amtrak’s  chief  information  systems  offi¬ 
cer),  DLP  turned  out  to  be  a  general  education 
tool  about  what  people  were  doing.Sometimes 
that  meant  finding  out  that  employees  were 
doing  things  online  that  had  to  be  stopped. 

Getting  the  attention  of  legal  staff  or  others 
on  the  business  side  wasn’t  always  easy  in 
terms  of  DLR  says  Baklarz,  but  probably  the 
best  approach  he  found  was  to  set  them  up 
with  a  log-in  to  the  Reconnex  console  so  they 
could  see  what  was  going  on.  ■ 


Lockheed  Martin 

continued  from  page  16 

ty  in  attributing  network  actions  to  specific  IP 
addresses,  due  to  the  ease  of  hijacking,"  Nejib 
says.  Morrison  says  all  these  issues,  particularly 
connection  hijacking,  have  the  potential  to 
cause  massive  headaches  for  corporate  IT 
departments  if  they  don’t  educate  their  users 
about  security  issues. 

“When  I  was  working  in  New  York  City  as  the 
IT  director  for  a  financial  services  company  we 
had  to  guard  against  potential  problems,  such 
as  drug  dealers  using  others’  unprotected  Wi-Fi 
networks  to  do  their  deals,”  Morrison  says.  “If 
we  had  left  those  Wi-Fi  connections  unpro¬ 
tected,  then  when  the  authorities  would  trace 
the  IP  addresses  of  drug  deals,  they  would 
have  gone  back  to  the  homes  of  one  of  our 
unsuspecting  employees,”  he  says. 

Another  concern  for  the  lab  is  the  spread  of 
Bluetooth  technology.  Although  Bluetooth 
generally  has  a  very  short  transmission  range, 
Crawford  notes  there  are  technologies  that 
can  pick  up  Bluetooth  signals  from  farther 
away  than  where  they’re  supposed  to  be 
accessible.  This  has  particularly  frightening 
implications,  because  sophisticated  hackers 
theoretically  could  use  Bluetooth  to  track  peo¬ 
ple’s  movements,  he  says. 

“Bluetooth  is  already  installed  in  most  semi- 
expensive  vehicles  right  now;’  Crawford  says.“If 
you  want  to  track  somebody’s  movements, you 
just  need  to  set  up  several  sleeper  PDAs  in  the 
area  where  they’re  traveling,  and  if  you  have  a 
high-enough  antenna,  you  can  pick  up  a  lot  of 
people’s  movements.” 

In  addition,  because  more  handsets  are 
being  equipped  with  Bluetooth,  Wi-Fi  and 
WiMAX  capabilities,  Crawford  says  these  secu¬ 
rity  vulnerabilities  are  expected  only  to  multi¬ 
ply  in  the  coming  years.'A  lot  of  these  features 
can  be  difficult  to  turn  off,  and  most  people 
don’t  even  know  about  them,”  he  says. “What’s 
more,  a  lot  of  these  devices  will  try  automati¬ 
cally  to  get  on  hot  spots.” 

The  problems  being  addressed  by  Lockheed 
Martin’s  wireless  security  lab  aren’t  limited  to 
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the  enterprise.  Most  of  them  also  are  becom¬ 
ing  increasingly  crucial  to  securing  the  mili¬ 
tary’s  battlefield  communications  networks. 
Currently,  the  company  is  helping  the  Army’s 
Warfighter  Information  Network-Tactical  pro¬ 
gram  build  a  mobile  network  that  can  span  an 
entire  theatre  of  operations  and  will  equip  all 
Humvees,  tanks  and  other  vehicles  with  IP 
radios  that  will  link  to  an  ad  hoc  network  capa¬ 
ble  of  delivering  100Mbps  of  data  to  soldiers 
on  the  move. 

“The  military  has  a  vision  of  having  an  IP 
address  for  every  soldier  and  weapon,” 
Morrison  says. “They ’re  not  going  to  be  trailing 
wires  around  on  the  battlefield,  but  that  can 
lead  to  some  vulnerabilities.” 

Just  as  corporate  users  are  vulnerable  when 
they  connect  to  enterprise  networks  using 
home  Wi-Fi  connections,  soldiers  are  at  their 
most  vulnerable  when  they  use  wireless  com¬ 
munications  in  crowded  urban  environments, 
Morrison  says.  He  acknowledges  that  urban 
battle  settings  are  difficult  to  recreate  in  a  lab¬ 
oratory  environment,  but  says  that  the  lab  has 
tried  using  fixed  and  mobile  communications 
systems  to  simulate  how  soldiers  will  travel  in 
the  theatre  of  operations. 

The  main  challenge  lies  in  creating  a  col¬ 
lection  of  wireless  nodes  that  can  pass  on 
information  to  low-power  or  low-bandwidth 
devices  effectively  while  still  being  able  to  be 
set  up  and  taken  down  as  quickly  as  the  mis¬ 
sion  dictates,  Nejib  says.The  stakes  on  the  bat¬ 
tlefield  are  certainly  higher  than  in  most 
home  offices,  but  corporate  networks  can 
learn  a  great  deal  from  how  the  military  effec¬ 
tively  deploys  wireless  networks  with  connec¬ 
tions  that  are  both  fluid  and  secure,  she  says. 

“This  concept  again  points  to  the  expansion 
of  the  network  beyond  traditional  bound¬ 
aries,”  Nejib  says.  “Cyber  and  wireless  security 
has  been  of  high  interest  due  to  its  almost  lim¬ 
itless  boundaries  and  the  fact  that  it  touches 
and  impacts  everyone,  not  just  the  military 
and  the  government.  This  newly  emerging 
wireless  world  will  only  succeed  if  all  of  the 
stakeholders  feel  they  can  trust  in  the  security 
of  the  network.”  ■ 
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SAVE  THE  DATE!  Mark  your  calendar  to  attend 


COMING  TO  A  CITY  NEAR  YOU 

IT  ROADMAP  IN  ’08! 


What  a  great  opportunity  to 
network  with  my  IT  peers  and  the 
outstanding  speakers  on  the  state 
of  IT. 

FRANK  CARLSON 

TELEHEALTH  AND  CONFERENCING  ENGINEER 
NORTHERN  COLORADO  MEDICAL  CENTER 


Network  World,  helped  us  acquire 
new  relationships  with  new  vendors, 
as  well  as  solidify  existing  relation¬ 
ships,  with  existing  vendors. 

SAJID  QURESHI 

IT  PROCUREMENT  AND  SERVICE 
DELIVERY  MANAGER 
HITT  CONTRACTING,  INC. 


IT  Roadmap  Conference  &  Expo’s  will  hit  the  road  in  2008  with  a  nationwide  tour 
including  new  cities,  new  topics,  new  speakers  and  new  sponsors!  That’s  right. 
You’ll  have  a  chance  to  attend  one  of  the  seven  events  we’ll  be  offering  next  year. 


You  won’t  want  to  miss  out  on  10  tracks  of  crucial  network  technology: 


>  VOIP,  VIDEO  &  UNIFIED 
COMMUNICATION 

>  SECURITY  AND  COMPLIANCE 

>  VIRTUALIZATION 

>  ENTERPRISE  MOBILITY 

>  NEXT-GENERATION  WAN  SERVICES 


>  NETWORK  MANAGEMENT,  AUTOMATION  &  CONTROL 

>  NETWORK  &  APPLICATION  ACCELERATION 

>  ENTERPRISE  COLLABORATION:  CONTENT 
MANAGEMENT,  SEARCH  &  SOCIAL  NETWORKING 

>  NAC:  NETWORK  ACCESS  CONTROL 

>  DATA  CENTERS  INFRASTRUCTURE  AND 
MANAGEMENT 


Complete  with  case  histories  from  front-line  users.  Data  from  industry  researchers. 
Insights  from  IT  specialists.  And  embedded  within...  a  tightly-focused,  solution 
oriented  expo  of  top  vendors. 

We  look  forward  to  seeing  you  in  2008! 


INTERESTED  IN  ATTENDING?  INTERESTED  IN  SPONSORING? 

www.networkworld.com/itr2008 


You  have  the  experience 
and  expertise  to  lead.  You 
have  the  insight  and  the 
foresight  to  help  shape  the 
direction  of  Network  World 
and  the  network  industry. 
You  have  the  knowledge 
that  leading  vendors  need 
to  determine  products  and 
enhancements. 


Be  among  the  select  advisors  who: 

>  contribute  to  online  surveys  and  provide  critical  feedback 

>  gain  access  to  study  results. 

>  connect  with  their  peers. 

>  expand  their  knowledge  through  panel  resources. 
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BACKSPIN 

Mark  Gibbs 


Windows  Media  Center  RIP? 


Digital  TV  was  (still  is?)  supposed  to  be  the 
next  big  thing  -  right?  The  goal  was  to 
both  improve  the  quality  of  broadcast 
television  and  free  up  radio  spectrum. 

The  problem  is  DTV  isn’t  flawless  and, 
arguably,  isn’t  even  on  par  with  traditional 
analog  television.  Early  adopters  have  dis¬ 
covered  reception  and  interference  prob¬ 
lems.  But  wait,  there’s  more. 

You  probably  thought  the  issue  of  the  broadcast  flag,  that  marker  that 
was  to  be  included  in  broadcast  signals  to  indicate  that  a  program  was 
not  to  be  recorded,  was  dead  and  gone.  Not  so. 

The  broadcast  flag  was  supposed  to  deliver  what  was  euphemistically 
called  “content  protection”  for  television  (more  accurately  it  was  Digital 
Rights  Management  or  DRM).And  the  FCC, bowing  deeply  to  pressure 
from  Big  Media,  mandated  that  DTV  tuners  monitor  for  the  broadcast 
flag  and  block  certain  functions, such  as  the  ability  to  record. 

The  Electronic  Frontier  Foundation  (EFF)  commented:“When  it 
comes  to  digital  recording,  it  would  be  Hollywood’s  DRM  way  or  the 
highway  Want  to  burn  that  recording  digitally  to  a  DVD  to  save  hard 
drive  space?  Sorry  the  DRM  lock-box  won’t  allow  it.  How  about  sending 
it  over  your  home  network  to  another  TV?  Not  unless  you  rip  out  your 
existing  network  and  replace  it  with  DRMd  routers.” 

The  EFF  challenged  the  FCC  in  2005,  and  a  court  ruled  that  the  FCC 
“lacked  authority  to  regulate  what  happens  inside  your  TV  or  computer 
once  it  has  received  a  broadcast  signal.” 

So,  the  whole  idea  was  thrown  out  —  sort  of.  It  turns  out  that  with  the 
rollout  of  DTY  one  broadcaster,  NBC,  is  using  the  broadcast  flag  and, 
one  small  company’s  products  are  obeying  it.  Microsoft. 

Yep,  it  turns  out  that  if  you  try  to  record  a  DTV  program  using 


Windows  Media  Center  and  the  broadcast  flag  is  set,  the  system  will 
refuse  to  record!  Not  only  does  this  means  you  can’t  record  a  flagged 
show,  you  can’t  even  pause  it  while  you  go  make  a  sandwich  or  answer 
yet  another  call  from  a  telemarketer. 

According  to  clnet,  Microsoft  defends  Vista  Media  Center’s  behavior 
thusly:“Microsoft  included  technologies  in  Windows  based  on  rules  set 
forth  by  the  FCC.  As  part  of  these  regulations, Windows  Media  Center 
fully  adheres  to  the  flags  used  by  broadcasters  and  content  owners  to 
determine  how  their  content  is  distributed  and  consumed.” 

Really?  So,  even  though  there  are  actually  no  “rules”  or  “regulations”  to 
be  obeyed,  by  law  Microsoft  has  complied.  In  other  words,  Microsoft  has 
sided  with  broadcasters  to  enforce  the  Big  Media’s  DRM  requirements! 
This  is  a  clear  case  of  Microsoft  conspiring  with  Big  Media  to  do  what 
Big  Media  wants  regardless  of  whether  consumers  object  or  not. 

The  arrogance  of  this  defies  belief.  Big  Media’s  plan  is  to  absolutely 
control  how  we  consume  music,  movies,  books  and  any  other  copy¬ 
righted  material,  no  matter  how  inconvenient  or  unfair  the  controls 
are.  The  goal  is  to  extract  as  much  money  from  us  as  they  can  for  each 
and  every  use  of  each  and  every  media  item,  and  Microsoft  is  making 
it  clear  who  it  is  aligned  with. 

What  is  intriguing  is  that  Microsoft  looks  to  have  painted  itself  into  a 
corner.  I’d  guess  the  company  won’t  disable  broadcast  flag  compli¬ 
ance,  which  means  the  Windows  Media  Center  product  line  will  wither. 
This  will  not  only  provide  market  leverage  for  other  DTV  recorder  ven¬ 
dors  that  ignore  the  flag  but  will  help  reinforce  the  argument  that  open 
source  products  have  the  advantage  where  control  and  functionality 
are  issues.  RIP  Media  Center. 

Gibbs  will  send  his  condolences  from  Ventura,  Calif.  Send  your  eulogies 
to  backspin@gibbs.com. 


Real  sticking  point  with  Microsoft/Yahoo! 

M 


NETBUZZ 

News,  Insights,  oddities 


icrosoft’s  desperate  struggle  to  acquire 
all  or  part  ofYahoo!  has  gotten  hung  up 
not  on  disagreement  over  a  fair  price  for 
the  latter’s  online  advertising  operations, 
sources  say  but  rather  the  value  ofYahoo!’s 
iconic  exclamation  point. 

“Ballmer  just  won’t  budge  on  this,  uh,  point,” 
says  one  source  close  to  the  negotiations.“He 
told  me, ‘Hell’s  bells, you  can  look  up'exclama- 
tion  point’  in  any  dictionary  and  see  a  picture 
of  me  next  to  the  definition. Why  should  I  pay  a  penny  for  theirs?”’ 

Yahoo!  isn’t  asking  for  pocket  change.  When  Microsoft  earlier  this 
month  pulled  the  plug  on  its  offer  of  $47.5  billion,  or  $33  per 
share, Yahoo!  was  reportedly  demanding  $1.50  per  share  more  — 
about  $2  billion  —  exclusively  for  the  exclamation  point. This 
despite  the  fact  thatYahool’s  founders  only  added  the  mark  after 
discovering  the  unadorned  word  Yahoo  had  already  been  locked 
up  by  a  barbecue-sauce  maker. 

With  news  last  week  of  a  renewed  overture  by  Microsoft,  it’s  possible 
that  Ballmer  may  be  softening  on  his  not-a-penny-for-the-point  position. 

Experts  insist  he  has  no  choice,  given  the  ample  precedent  for  corpo¬ 
rations  placing  hefty  price  tags  on  their  famous  punctuation.  And,  as 
one  noted  to  me,  the  exclamation  point  onYahool’s  home  page  may 
be  the  only  one  on  the  Internet  that  actually  yodels  when  clicked. 

“That  alone  tacks  a  couple  hundred  million  on  the  price,”  he  said. 

Wall  Street  types  familiar  with  the  situation  inevitably  recount  the 
2005  war  between  SBC  and  AT&T  over  the  valuation  of  the  latter’s 
ampersand.  At  one  point  the  negotiations  nearly  broke  off  after  SBC 
claimed  it  had  no  intention  of  paying  for  the  ampersand  because  it 
had  no  intention  of  retaining  the  AT&T  moniker. 

“Threats  don’t  get  any  emptier,”  a  source  told  me. “That  $16  bil¬ 


lion  deal  was  a  $15  billion  deal  without  the  amp.” 

In  its  fiscal  year  2007  filing  with  the  Securities  and  Exchange 
Commission,  EMC2  affixed  a  $50  million  “estimated  market  value”  on 
the  company’s  exponent,  while  noting  that  it  would  be  significantly 
higher  if  more  people  knew  what  it  meant  or  how  to  create  one  in 
Microsoft  Word  (type  a  normal  2,  highlight  it,  press  Ctrl,  shift  and  the 
plus  sign  simultaneously). 

“Everybody  knows  the  Yahoo!  exclamation  point,”  my  source  noted, 
“and  the  [bleeping]  thing  yodels.  EMC’s  silly  little  two  doesn’t  do  squat.” 

Sooner  or  later,  Microsoft  is  going  to  have  to  pony  up  for  the  point. 

You  knew  that  was  all  a  joke,  right? 

Of  course, you  did,  but  I  ask  because  when  I  posted  this 
“sticking/exclamation  point”  item  to  my  blog  last  week  it  was  met  in 
some  quarters  with  alarming  credulity  Among  the  choicer  comments 
posted  on  Digg,  for  example: 

“Isn’t  the  !  included  in  the  value  of  the  company?” 

“I  don’t  get  it,  are  they  actually  going  to  continue  using  the  name 
after  acquisition?  If  not,  then  why  [care]  about  it?” 

“Is  this  some  kind  of  The  Onion-style  thing,  or  have  my  worst  night¬ 
mares  come  true?” 

When  writing  the  post  I  considered  the  possibility  that  some  might 
take  it  seriously  —  someone  almost  always  does  —  but  presumed  the 
chances  were  miniscule  because,  among  other  reasons,  I  had  set  the 
dollar  amounts  preposterously  high  —  not  high  enough. 

Lesson  learned:  If  it’s  this  easy  to  fool  people  when  you’re  trying  to 
avoid  fooling  them,  imagine  how  easy  it  would  be  if  that  was  your 
intent.  By  the  way,  the  part  about  the  Yahoo!  exclamation  point  yodel- 
ing?  That’s  true.  Go  try  it. 

Have  any  punctuation  to  sell?  The  address  is  buzz@nww.com. 
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DNS  CHANGE  MAKERS 


HILBERT’S  LAW. 


In  today's  world,  computers  are  like  telephones;  everyone  has  them  and  everyone  uses  them. 
Cyber  criminals  are  no  different.  Computers  are  simply  a  path  to  a  crime  and  paths  can  be 
followed.  The  days  of  online  anonymity  are  gone.  With  the  proper  tools,  cyber  criminals  can 
be  tracked  and  caught. 


Cyber  crime  is  on  the  rise  because  computer  use  is  universal. 
Pedophiles,  identity  thieves,  hackers,  virus  writers,  social 
engineers  and  even  terrorists  are  using  the  Internet  to 
further  their  varying  schemes,  scams  and  deeds.  The 
Cyber  War  is  raging  and  for  all  of  them,  their  achilles 
heel  is  DNS.  As  a  former  FBI  Cyber  Agent  and  a  current 
Cyber  Security  Professional,  I  know  that  one  of  the 
ways  to  win  this  war  is  having  the  right  tools  that  can 
quickly  track,  troubleshoot  and  accurately  analyze 
DNS  activity. 


When  the  battle  is  on,  the  one  source  I  turn  to 
that  provides  me  with  the  comprehensive  tools  I 
need  is  DNSstuff.com.  When  you  deal  with  issues 
I  deal  with  on  a  daily  basis,  you  learn  quickly 
all  DNS  tools  are  not  equal. 


E.J.  Hilbert,  Former  FBI  Agent  &  Director  Security  Enforcement,  MySpace 


■1  DNSstuff.com 

WHEN  GOOD  ISN’T  GOOD  ENOUGH. 


DELL  M600  BLADE  SYSTEM 


fMIK 


PER  WATT 


GET  MORE  PERFORMANCE  PER  WATT  AT 

DELL.COM/Blades  or  call  866.212.9338 


Based  on  Principled  Technologies'  “SPECjbb2005  performance  and  power  consumption  on  Dell,  HP,  and  IBM 
blade  servers”  December  2007  test  report  commissioned  by  Dell. 


